---
title: "Revolve saved-payment-information incident"
description: "Revolve disclosed unauthorized system access and possible acquisition of saved customer payment information."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-31"
canonical_url: "https://www.ally.security/incidents/revolve-saved-payment-information-incident-2026"
markdown_url: "https://www.ally.security/incidents/revolve-saved-payment-information-incident-2026.md"
stix_url: "https://www.ally.security/incidents/revolve-saved-payment-information-incident-2026/stix.json"
---

# Revolve saved-payment-information incident

Its SEC filing distinguishes confirmed unauthorized access from the still-assessed scope of payment-data acquisition.

Last modified Oct 31, 2026 · 1 source

## Summary

- **Environment:** Revolve systems and customer accounts with saved payment information
- **Operational impact:** Company reported no operational disruption or service interruption
- **Financial impact:** No confirmed incident cost quantified

## What happened

[Revolve Group](https://www.revolve.com/) said it recently discovered unauthorized system access, remediated the activity and continued assessing its scope. [1](#source-1)

## Impact

Revolve believed an actor may have obtained names, contact information, payment-card numbers and expiry dates for certain customers who saved payment details in their online accounts. It reported no operational disruption and did not believe the incident would materially affect its business as of the filing. That assessment is not a quantified zero cost. [1](#source-1)

## Timeline

### October 29, 2026 — Unauthorized access disclosed in SEC filing

The [Form 8-K](https://www.sec.gov/Archives/edgar/data/1746618/000119312526439022/rvlv-20261029.htm) does not establish attack or detection dates. [1](#source-1)

### October 31, 2026 — Briefing updated

This briefing was last reviewed and updated on October 31, 2026.

## Threat Group & Attack Vector

The company described potential acquisition through automated means without identifying the precise access path, actor or affected-customer total. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Revolve engaged outside experts, contacted law enforcement and added security measures while investigating the impact. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/revolve-saved-payment-information-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Revolve Group Form 8-K — October 29, 2026

official · Revolve · Oct 29, 2026

<https://www.sec.gov/Archives/edgar/data/1746618/000119312526439022/rvlv-20261029.htm>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Disclosed At · 100% confidence · current**  
   Revolve saved-payment-information incident: 2026-10-29
2. **Resulted In · 100% confidence · current**  
   Revolve saved-payment-information incident: Revolve believed the actor may have obtained through automated means names, contact information, payment-card numbers and expiration dates for certain customers who saved payment information in their online accounts.
3. **Resulted In · 100% confidence · current**  
   Revolve saved-payment-information incident: Unauthorized access disclosed in SEC filing
4. **Resulted In · 100% confidence · current**  
   Revolve saved-payment-information incident: Revolve Group said it recently discovered unauthorized access to its systems and remediated the unauthorized activity while assessing its scope.
5. **Resulted In · 100% confidence · current**  
   Revolve saved-payment-information incident: Revolve engaged outside experts, contacted law enforcement and implemented additional security measures. The filing did not establish the attack date, detection date, number of affected customers or actor identity.
6. **Affected Organization · 100% confidence · current**  
   Revolve saved-payment-information incident: Revolve Group
7. **Resulted In · 100% confidence · current**  
   Revolve saved-payment-information incident: Revolve said the incident had not disrupted operations or service and, as of the filing, it did not believe there would be a material effect on its business, financial condition or operating results. This is a time-bounded assessment, not a quantified zero cost.
8. **Occurred At · 100% confidence · current**  
   Unauthorized access disclosed in SEC filing: 2026-10-29

</details>