Incident BriefingsRevolve saved-payment-information incident

Revolve saved-payment-information incident

Its SEC filing distinguishes confirmed unauthorized access from the still-assessed scope of payment-data acquisition.

Last modified

Summary

  • Environment: Revolve systems and customer accounts with saved payment information
  • Operational impact: Company reported no operational disruption or service interruption
  • Financial impact: No confirmed incident cost quantified
  • Record status: Developing record. Reviewed October 31, 2026; updated as evidence emerges.

What happened

Revolve Group said it recently discovered unauthorized system access, remediated the activity and continued assessing its scope. [1]

Impact

Revolve believed an actor may have obtained names, contact information, payment-card numbers and expiry dates for certain customers who saved payment details in their online accounts. It reported no operational disruption and did not believe the incident would materially affect its business as of the filing. That assessment is not a quantified zero cost. [1]

Timeline

  1. Unauthorized access disclosed in SEC filing

    The Form 8-K does not establish attack or detection dates.

    [1]

  2. Briefing updated

    This briefing was last reviewed and updated on October 31, 2026.

Threat Group & Attack Vector

The company described potential acquisition through automated means without identifying the precise access path, actor or affected-customer total. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific MITRE ATT&CK technique is currently mapped for this case.

Response

Revolve engaged outside experts, contacted law enforcement and added security measures while investigating the impact. [1]