Revolve Confirms Data Breach Impacting 1.5 Million Customers After September Intrusion
Online fashion retailer Revolve has updated the Indiana Attorney General’s Office with a final victim count of 1,515,073 individuals affected by the data breach first disclosed in October. The company initially reported the incident to the US Securities and Exchange Commission on October 29 and began notifying customers around the same period. Earlier regulatory filings in five states had only accounted for roughly 197,000 impacted people combined. Attackers gained access to Revolve systems, including its e-commerce platform, on September 11 and were detected on September 29. The exposed data includes names, contact details, mailing addresses, and stored payment card numbers with expiration dates for customers who saved payment methods in their accounts. Revolve notified federal law enforcement and engaged external cybersecurity experts, though the initial access method remains undisclosed and no group has claimed responsibility.
SecurityWeekNov 9, 2026Translated from English