Saved a Card at Revolve? Hackers May Have Taken Your Payment Details

Saving your card at Revolve made checkout easier. Now, those payment details may have ended up in an intruder’s hands.

Revolve Group disclosed on Oct. 29 that an unauthorized actor may have obtained names, contact information, card numbers, and expiration dates belonging to certain customers who saved payment information in their accounts.^[1]

Thanks for subscribing!

Please check your email for your first message.

Never miss the privacy news that affects you.

Join thousands who get the latest security news, scams, and policy changes every week, right to their inbox.

Sign me up

By submitting this form you agree to receive emails from All About Cookies and to the privacy policy and terms.

What happened in the Revolve data breach?

Revolve disclosed unauthorized access to some of its systems in an Oct. 29 SEC filing. The company said it stopped the unauthorized activity, strengthened security, notified federal law enforcement, and hired outside cybersecurity experts.

SecurityWeek reported that hackers may also have accessed and exfiltrated addresses, and that the incident occurred Sept. 11, 2026, involving unauthorized access to certain systems, including Revolve’s online shopping platform.

What information was exposed in the Revolve breach?

Revolve said the potentially affected information belonged to certain customers who saved payment details in their online accounts. It could include:

• Names
• Contact information
• Payment card numbers
• Payment card expiration dates

How many Revolve customers were affected?

Revolve’s SEC filing does not give a total. A Dapeer Law summary of state filings reports 1,515,073 affected individuals, attributing that figure to a Texas attorney general filing.

Revolve said the incident hadn't caused operational disruption or interrupted customer service. The company also said on Oct. 29 that it didn't believe the incident would materially impact its business.

What are the risks if your saved card was exposed?

The immediate concern is unauthorized card charges. Criminals could try online purchases or small transactions to test whether a card works. If Revolve confirms your card was affected, contact your issuer and ask about replacing it.

Names, addresses, and contact information also make phishing easier. A scam message that references Revolve, your saved card, or your shipping address can look more convincing than a generic fake. If you want a refresher on red flags, All About Cookies has a guide to spotting phishing emails.

In an All About Cookies survey, 38% of respondents who had experienced identity theft said criminals obtained their information through a data breach.

The risk tied to the card itself can drop once the card is canceled and replaced. The risk tied to your name, address, and contact details can last much longer because that information doesn't change easily.

What should you do after the Revolve data breach?

Start with your card issuer, then tighten up the account and phishing risks around it.

1. Read your Revolve notice. If you receive a letter or email from Revolve, review the exact data listed and follow the instructions in the notice.
2. Contact your card issuer and check transactions. If your notice identifies an affected card, call the number on the back and ask about replacement. Review recent transactions, report unfamiliar charges immediately, and enable transaction alerts if available.
3. Review saved payment details. Visit Revolve’s official website or app directly and remove cards you no longer want stored. Removing a saved card does not invalidate details already stolen.
4. Watch for Revolve-themed phishing. Be cautious with messages about refunds, card verification, shipping problems, or breach support. Don't enter card details through links in unexpected texts or emails, and consider security software with phishing protection if you often shop online.
5. Change reused passwords and turn on two-factor authentication. The disclosed data doesn't include passwords, but attackers may use your contact details to try account takeover scams. Use a unique password for Revolve and enable two-factor authentication when available.
6. Consider tools for broader identity risks. Identity theft protection may offer monitoring and recovery assistance, while credit monitoring tracks changes to your credit file. Credit monitoring does not flag fraudulent purchases on an existing card. A data removal service may help reduce publicly available contact information scammers could use.

Bottom line

The Revolve breach may have exposed payment details for customers who saved cards in their accounts. If you receive a notice, contact your card issuer, review transactions, and verify any Revolve-themed messages before sharing information.

4.8

AllAboutCookies writers and editors score products based on a number of objective features as well as our expert editorial assessment. Our partners do not influence how we rate products.

Editorial Rating

See Price

On LifeLock's website

2026 Editors’ Choice

Best ID Theft Service for Comprehensive Monitoring

Identity Protection

LifeLock

• ID theft protection with U.S.-based restoration specialists and data removal services
• At least $1.05 million in ID theft insurance on every plan, with the Total plan covering up to $3 million
• Three-bureau credit monitoring available on Advanced and Total tiers

Author Details

Kalleigh Lane

About the Author

Kalleigh Lane is the Managing Editor at All About Cookies, where she helped develop the site's star rating system for product reviews and specializes in testing VPNs, ad blockers, and parental controls on Android and PC. She brings more than five years of experience editing and writing across cybersecurity, tech, and finance, and she has authored and edited over 300 articles for All About Cookies. Before joining AAC, she worked as a journalist and editor at CTV News and the Globe and Mail, and she holds a Master of Arts in English Literature from the University of Toronto.