Revolve Data Breach Affects at Least 179,259 People

Summary

Revolve says attackers accessed some systems, including its shopping platform. Its investigation found customer names, addresses and saved payment-card details may have been accessed and exfiltrated; at least 179,259 people received notices.

Key points

• The incident occurred on September 11 and involved unauthorized access to Revolve systems, including its online shopping platform.
• Revolve’s investigation found that names, addresses, payment-card numbers and expiration dates saved to customer accounts may have been accessed and exfiltrated.
• Notices filed with attorneys general in Iowa, Massachusetts, Texas and Vermont indicate at least 179,259 people were notified.
• Revolve says it contained and remediated the unauthorized activity, notified law enforcement and hired a cybersecurity company to assist.
• The company reported no service disruption and said it did not expect a material business impact; it did not identify the attacker or explain how access occurred.
• Revolve is not offering free identity-theft or credit monitoring, but advised affected individuals to review account statements and watch for fraud.