Revolve Data Breach Exposes Payment Details of 180,000 Customers

Online fashion retailer Revolve is notifying at least 180,000 individuals that their personal and payment card information was compromised in a data breach.

The incident, which occurred on 11 September, involved unauthorised access to the company’s online shopping platform and other systems.

Exposed Customer Information

In a filing with the US Securities and Exchange Commission (SEC), the company stated that its investigation determined hackers may have accessed and exfiltrated the names, addresses, payment card numbers, and expiration dates of customers who had saved their payment details to their accounts on the e-commerce platform.

Revolve noted that the incident has not resulted in operational disruptions or interrupted services to its customers. The company also indicated that it does not believe the breach will have a material impact on its business operations.

Response and Notifications

Immediately after learning of the cyberattack, Revolve initiated incident response protocols to contain and remediate the unauthorised activity. The retailer has notified law enforcement and engaged a cybersecurity firm to assist with remediation efforts.

Based on notices filed with the Attorneys General in Iowa, Massachusetts, Texas, and Vermont, Revolve has sent notification letters to at least 179,259 potentially affected people. The company has not yet disclosed the identity of the threat actor or the specific method used to gain access.

Revolve is not providing affected individuals with free identity theft or credit monitoring services. Instead, the company has advised customers to remain vigilant and to regularly review their account statements for any signs of fraud or identity theft.