What to Do After the Revolve Data Breach (Saved Card Numbers Stolen)

What Happened in the Revolve Data Breach

Revolve Group, the Los Angeles fashion retailer behind Revolve.com, disclosed in an SEC filing and in letters to customers that an unauthorized actor got into its online shopping platform and may have obtained saved payment card data "through automated means." Records filed with the Texas attorney general show the intrusion happened on September 11, 2026 and was discovered on September 29, 2026. Notification letters went out in late October and early November.

Revolve has not said how the attacker got in, and no hacking group has publicly claimed the attack. The company says the activity has been contained and remediated and that it has added security measures, without detailing what they are.

How Many People Were Affected?

Revolve has not published a total. State filings add up to at least 179,259 people: 127,200 in Texas, 46,813 in Massachusetts, 3,918 in Iowa and 1,328 in Vermont, with further notices filed in other states including California and South Carolina. Malwarebytes found a figure of 1,515,073 in data behind the Texas attorney general's breach portal labeled as the total affected, but it is not shown publicly and Revolve has not confirmed it. Treat 1.5 million as possible, not proven.

What Data Was Exposed

• Full names
• Contact information, including mailing address and email
• Payment card numbers
• Card expiration dates

Only customers who had saved a card as a payment method in their Revolve account were affected. Revolve's SEC filing does not mention CVV security codes, which are normally not stored. That limits, but does not remove, the risk: a card number with an expiration date, name and billing address is enough for fraud at some merchants and for very convincing phishing.

Step 1: Get a New Card Number

Call the number on the back of the card you had saved at Revolve and ask the issuer to cancel it and reissue it with a new number, not just a replacement plastic. This is the single step that makes the stolen data worthless. Once the new card arrives, update any subscriptions or wallets that used the old one. Our guide on what to do if your credit card information is stolen covers the full process.

1. 2

   Step 2 of 6: Review Statements Line by Line

   Go back through every statement since September 11, 2026. Card thieves often test stolen numbers with small charges of a dollar or two before making larger purchases, so look for small, unfamiliar or oddly named merchants. Report anything you don't recognize to your issuer immediately; under US law your liability for unauthorized credit card charges is capped at $50, and most issuers waive even that.

2. 3

   Step 3 of 6: Turn On Transaction Alerts

   Enable push or text alerts for every card transaction, or at least for online and card-not-present purchases, in your bank's app. Alerts catch fraud in minutes instead of at the end of the billing cycle.

3. 4

   Step 4 of 6: Watch for Revolve-Themed Phishing

   Criminals holding your name, email, address and partial card details can write very convincing messages — "your Revolve refund is ready," "verify your card to keep your order," or a fake fraud-department call quoting your card's last digits. Revolve's letters do not ask you to click links or confirm card details. If anyone contacts you about the breach, hang up or ignore it, and call the number printed on your card instead. See our guide to recognizing and avoiding phishing scams for the warning signs.

4. 5

   Step 5 of 6: Stop Saving Cards on Shopping Sites

   Delete saved cards from your Revolve account and other retailers you rarely use. For online shopping, a digital wallet like Apple Pay or Google Pay, or a virtual credit card, means the merchant never stores your real card number, so the next breach can't expose it.

5. 6

   Step 6 of 6: Shrink the Rest of Your Exposed Profile

   Your card can be replaced; your name, address and email cannot. Fraudsters combine breach data with people-search sites that publish your phone number, relatives and address history to make scams more believable. Removing yourself from those sites cuts the data they can pair with this leak. A data removal service automates that across 100+ brokers.

Should You Freeze Your Credit?

Revolve's disclosures do not list Social Security numbers or dates of birth among the stolen data, so this breach on its own does not let someone open new credit in your name. A credit freeze is still free, takes about 15 minutes at Equifax, Experian and TransUnion, and protects you against the next breach that does include an SSN. It is worth doing if you have not already.

Is There a Revolve Data Breach Class Action?

Law firms have begun investigating claims against Revolve Group, which is common after any breach involving payment data. If a settlement is reached, you will typically be notified by mail or email and can file a claim then. Keep your Revolve notification letter and records of any fraudulent charges or time spent dealing with the breach. Our guide on how to file a data breach settlement claim explains what documentation helps.

Frequently Asked Questions