Revolve Puts Data Breach Victim Count at 1.5 Million

Online fashion retailer Revolve revealed that a September cyberattack compromised the personal records and payment details of 1,515,073 individuals, according to a breach notification filed with the Indiana Attorney General's Office and detailed in SecurityWeek's report. The disclosure marks the first comprehensive tally of victims since Revolve filed an initial notice with the US Securities and Exchange Commission on October 29. While early state filings showed smaller localized numbers, the filing with Indiana regulators confirms the nationwide scale of the compromise across the apparel platform's customer base.

This report covers the technical timeline, the scope of customer records accessed, the response steps taken by the retailer, and the outstanding operational questions surrounding the intrusion. It is intended for online retail customers, cybersecurity response teams, and e-commerce compliance managers reviewing payment security and stored-credential exposure. The breach specifically centers on customers who maintained saved payment methods inside their online accounts, underscoring the ongoing operational risks associated with holding card numbers on retail servers.

01What broke

An unauthorized party broke into Revolve's network on September 11, successfully infiltrating internal systems that included the retailer's core e-commerce platform. The intrusion persisted undetected within the retailer's environment for eighteen days until internal personnel or monitoring controls discovered the activity on September 29. During that window, the intruder gained operational access to databases housing sensitive shopper records and account profiles, allowing automated tools to pull records directly from store databases.

The attacker extracted personal profiles and financial data specifically tied to user accounts with active stored billing profiles. Revolve's subsequent investigation confirmed that the intruder used automated mechanisms to harvest names, contact details, mailing addresses, payment card numbers, and card expiration dates. The retailer formally disclosed the incident to the SEC on October 29, began mailing individual notification letters to impacted shoppers around the same date, and brought in outside cybersecurity firms to contain the unauthorized access.

02Who is exposed

The breach directly impacts 1,515,073 shoppers registered on Revolve's retail systems across the United States. Initial state-level regulatory disclosures provided an incomplete picture of the overall victim population, listing approximately 197,000 affected residents across five states: Iowa, Massachusetts, South Carolina, Texas, and Vermont. The filing submitted to the Indiana Attorney General's Office established the complete aggregate total of individuals whose records were compromised during the multi-week system intrusion.

Exposure is strictly confined to shoppers who opted to store a payment method in their Revolve online accounts prior to the attack. Customers who checked out as guests or who chose not to save payment cards for future purchases did not have their financial instruments compromised in this database theft. For registered users with saved credentials, the accessed information includes their full legal names, contact information, physical shipping and mailing addresses, payment card numbers, and card expiration dates.

03What to do now

Customers who received a written notice from Revolve or who maintain an online account with stored payment information must monitor their bank statements closely for unauthorized debit or credit charges. Because payment card numbers and expiration dates were exfiltrated directly, account holders should contact their card issuers to request replacement cards and new account numbers. Users should also review online accounts to remove any obsolete saved billing cards and update authentication passwords across their e-commerce profiles.

Revolve alerted federal law enforcement authorities immediately after discovering the breach and retained external digital forensics specialists to manage incident containment and technical response. Retailers handling customer payment profiles should review internal cardholder data retention rules, audit access logs for automated query spikes, and confirm that stored payment tokens or credentials receive strict perimeter isolation. Affected shoppers can also consult formal state attorney general listings to verify the authenticity of breach notices mailed in late October.

04How the issue works

The intrusion took place across multiple connected corporate systems, directly hitting the web e-commerce platform that processes customer purchases. Between the initial entry on September 11 and discovery on September 29, the adversary deployed automated extraction tools across Revolve's data repositories. The automated script systematically queried backend databases to identify and aggregate stored card records, compiling customer names alongside matching addresses and active card details without tripping immediate disruption alarms on the storefront.

Because the automated mechanism specifically extracted saved payment instruments, it targeted backend account storage tables rather than point-of-sale memory scrapers. This operational behavior allowed the threat actor to harvest card numbers and matching expiration dates en masse from existing account repositories. Once Revolve detected the intrusion on September 29, the company engaged external cybersecurity consultants to isolate the compromised platform segments, initiate forensic analysis, and prepare regulatory filings for the SEC and state attorneys general.

05What is still unknown

Revolve has not disclosed the specific initial access vector used by the attacker to bypass boundary defenses on September 11. It remains unconfirmed whether the intruder leveraged stolen employee credentials, exploited an unpatched vulnerability in the e-commerce software stack, or penetrated via a third-party vendor integration. The retailer has also not publicly detailed the specific cybersecurity consulting firm assisting the investigation or whether card verification value security codes were stored or touched during the automated sweep.

No extortion group, ransomware syndicate, or individual hacker has publicly claimed responsibility for the cyberattack or posted sample files on dark web leak sites. Additionally, while the Indiana filing established the total victim count at 1,515,073, Revolve has not released an itemized breakdown of victims across all remaining US states. Law enforcement inquiries with federal investigators remain open, and authorities have not indicated whether any portion of the stolen records has appeared in underground credit card fraud markets.