Fashion Retailer Revolve Reports Payment Card Data Breach

Online fashion retailer Revolve has alerted investors to a significant data breach that resulted in cybercriminals accessing customer payment card information, including numbers and expiration dates. The company disclosed the incident in an 8-K filing with the Securities and Exchange Commission (SEC), stating that hackers gained unauthorized access to multiple company systems.

An initial investigation revealed that threat actors employed "automated means" to exfiltrate sensitive data from customers who had saved their payment information on Revolve's e-commerce platform. The compromised data includes customer names, contact information, payment card numbers, and expiration dates. Revolve has not yet specified when the attack occurred.

In response to the breach, Revolve has notified federal law enforcement agencies and engaged a cybersecurity firm to lead the recovery and investigation efforts. The company stated that the attack did not cause operational disruptions and is not expected to have material financial impacts.

While Revolve has not disclosed the total number of affected customers nationwide, it reported to regulators that 127,200 individuals in Texas had their information stolen. Additionally, 1,328 victims were identified in Vermont, and breach notifications were also filed in Massachusetts, indicating a multi-state impact.

Founded in 2023, Revolve operates as a major online fashion retailer, featuring over 1,600 brands and reporting substantial net sales. The incident highlights the persistent threat faced by e-commerce platforms, particularly concerning the theft of payment card data, a frequent target for cybercriminals.

Over the past two years, numerous large fashion retailers, including Asos, Levi Strauss, and Mango, have fallen victim to cyberattacks, underscoring the ongoing challenges in securing sensitive customer financial information within the retail sector.