Key takeaway: Merchants that let customers save cards in online shopping accounts hold the same data attackers took from Revolve. The incident is a prompt to review how merchants protect and monitor saved payment details heading into the holiday shopping season.
Fashion retailer Revolve disclosed in an SEC filing that attackers used “automated means” to access multiple company systems. The Record reported on October 30 that the attackers stole customer names, contact information, payment card numbers, and expiration dates.
Revolve’s initial investigation found the stolen data came from customers who had saved payment information in their online shopping accounts. The company did not say when the attack happened and did not state how many people were affected in total.
State filings give a partial count. Revolve told Texas regulators that attackers stole information belonging to 127,200 Texas residents, and Vermont reported 1,328 affected residents. Revolve also filed breach notifications in Massachusetts. Because Revolve has not published a national total, these state filings show only part of the exposure.
Revolve notified federal law enforcement and hired a cybersecurity firm to lead recovery. The company reported no operational disruptions and said it does not expect a material financial impact from the incident.
Why it matters: Stolen card numbers and expiration dates feed card-not-present fraud, which often surfaces later as chargebacks for merchants and issuers. The disclosure comes just ahead of peak holiday transaction volume. Revolve’s undisclosed breach date also leaves open how long the data was exposed. The Record names Asos, Levi Strauss, Foschini Group, Mango, North Face, Harrods, M&S, and The Co-op among other fashion and retail brands hit by cyberattacks over the past two years. The frequency of these incidents shows how often apparel retailers are targeted.