1. Executive summary
Online fashion retailer Revolve Group has told customers that their names, addresses, payment card numbers and card expiration dates were stolen, in a notification filed with the Massachusetts Attorney General and reported by Malwarebytes. The breach affected only customers who had saved a payment card to their Revolve account. A Texas attorney general record lists 127,200 affected Texans, and a figure of 1,515,073 appears in data returned by that site, but Revolve has not confirmed a total and its SEC filing gives no number. No CVV is mentioned in the SEC filing, and Revolve has not said whether card numbers were stored in full or masked, or whether Revolve or a payment processor held them. For EMEA financial services the exposure is indirect: cardholders at client banks may hold compromised card credentials, and the absence of a confirmed CVV position means card-not-present fraud risk on those accounts cannot be ruled out from public reporting.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item.
3. Technical analysis & attack chain
Revolve has not disclosed how the data was accessed. The confirmed sequence from public reporting is short.
- On 11 September 2026, according to records on the Texas attorney general data breach site, the incident occurred.
- On 29 September 2026, again per the Texas records, the incident was discovered.
- Revolve notified affected customers by letter filed with the Massachusetts Attorney General, stating that names, addresses and payment card details were involved.
- Revolve filed with the SEC, stating it believes an unauthorised actor may have obtained the data "through automated means".
That is the extent of the confirmed chain. The initial access vector, the exploited component, any vulnerability or CVE, the payload, persistence, privilege escalation, command-and-control, lateral movement and exfiltration mechanism are not stated in public reporting. No CVE has been assigned. No group has publicly claimed responsibility for the theft.
Data scope. The at-risk data is customer names and contact information, payment card numbers and card expiration dates. The breach affected only customers who had saved a payment card as a payment method in their Revolve account. Revolve's SEC filing does not mention card verification value (CVV) numbers. It is unclear whether card numbers were fully visible or masked, and whether Revolve or a third-party payment processor held them. The volume of records taken is not confirmed: the Texas attorney general listing shows 127,200 affected Texans, and the figure 1,515,073 appears in data returned by a search of that site labelled as the total number of people affected, but the figure is not displayed on the public listing and Revolve has not confirmed it. Other outlets repeating the figure appear to rely on the same Texas record, so it is single-sourced to that record and should be treated as unconfirmed.
The "automated means" wording is Revolve's own characterisation in its SEC filing and carries no technical detail. It does not establish web scraping, credential stuffing, an API flaw or any other specific mechanism, and Adverse Trace does not infer one. The gap between the 11 September occurrence and 29 September discovery, eighteen days, is stated by the Texas records; the cause of the delay is not reported.
Fraud implications. Card number plus expiration date, without a CVV, can be sufficient to make purchases at some online stores, per Malwarebytes. The same combination of real card details and contact information makes phishing that solicits the CVV more convincing. Malwarebytes notes fraud can begin within days of a breach. This is a card-not-present fraud exposure, not a ransomware or extortion event on the public record; no data-theft or leak-site claim has been made.
4. Mitigation & containment
The affected organisation is Revolve, a US retailer. EMEA financial services clients are exposed as card issuers and as parties whose customers may hold Revolve accounts. The steps below are for issuers and for clients assessing their own exposure. No fixed release, patch or vendor remediation is named in public reporting, because the access vector has not been disclosed.
P1 within 24h
- Identify cardholders who have transacted with Revolve and flag their cards for enhanced transaction monitoring, prioritising card-not-present merchants and small-value test authorisations. Malwarebytes notes criminals often make a small charge first to test whether stolen card details work.
- Brief fraud operations and contact-centre staff that customers may receive calls, texts or emails referencing the Revolve incident and asking for a CVV. The advisory position is that a caller claiming to be from a card issuer should be verified by calling the number printed on the card, not a number supplied in the inbound contact.
- Do not treat the 1,515,073 figure as a confirmed population. Scope monitoring from your own cardholder overlap with Revolve, not from the unconfirmed total.
P2 within 72h
- Where a cardholder confirms a saved card at Revolve and requests it, reissue the card with a new number so the old number becomes unusable, per the guidance Malwarebytes relays.
- Review whether your card controls permit card-not-present transactions without a CVV at merchants that accept them, and consider step-up authentication for those transactions on flagged accounts.
P3 within 7 days
- Run a retrospective fraud review over the period from 11 September 2026 onward for flagged accounts, looking for unfamiliar merchant names and unrecognised charges.
- If your institution is a supplier or payments partner to Revolve, verify directly with Revolve what data it held, whether numbers were masked, and whether a processor was involved. Public reporting does not answer these questions.
5. Indicators of compromise
No indicators of compromise available in the source material.
The source gives no hashes, domains, IP addresses, file paths or command lines. The only observable behaviours are the incident timeline and the data types involved, which are not machine-pivotable and are covered in §3.
6. Detection
Insufficient indicators to author detection rules.
7. Sources
- Malwarebytes, "Revolve card breach: 1.5 million people may be affected", https://www.malwarebytes.com/blog/data-breaches/2026/11/revolve-card-breach-1-5-million-people-may-be-affected, 2026-11-03.
The primary item and the related source are the same Malwarebytes article. Facts attributed to Revolve's Massachusetts Attorney General notification, its SEC filing and the Texas attorney general data breach site are reported second-hand through that article; the underlying filings were not independently reviewed for this advisory.
8. Adverse Trace position
Adverse Trace assesses this as a moderate card-fraud exposure for EMEA financial services, not a direct compromise of client infrastructure. The confirmed facts are limited: card numbers and expiration dates for customers who saved a card at Revolve, an occurrence date of 11 September 2026 and discovery on 29 September 2026 per Texas records, and no confirmed CVV exposure, no confirmed record count and no disclosed access vector. The 1,515,073 figure is single-sourced to a Texas attorney general record and unconfirmed by Revolve; we will not treat it as established. No actor is named by any source and no group has claimed the theft, so there is no attribution to carry. We will monitor for Revolve's confirmation of the record count and for any statement on CVV and masking, and we will reissue this note if an access vector or a claim of responsibility emerges. Clients should prioritise cardholder overlap identification and CVV-phishing awareness over technical containment, which does not apply to this event.
Published via PulseTrace — Adverse Trace threat intelligence.