Overview
Online fashion retailer Revolve has told regulators that its September cyberattack affected 1,515,073 individuals, according to a filing with the Indiana Attorney General. The company had not previously published a total.
Timeline
- September 11 — the intrusion occurred
- September 29 — Revolve discovered it, per the Indiana filing
- October 29 — Revolve disclosed the incident in a U.S. SEC filing and began sending notification letters
Earlier notices to regulators in Iowa, Massachusetts, South Carolina, Texas, and Vermont covered about 197,000 people combined, so the Indiana filing reveals a much larger scope.
Data Exposed
The compromised information includes:
- Customer names
- Contact details, including mailing addresses
- Payment card numbers with expiration dates
Only shoppers who had saved a payment method in their online account were affected. The intruder reportedly used "automated means" to collect the data.
Attribution and Response
No threat actor has claimed the attack, and Revolve has not explained how the attackers gained access. The company reported the incident to federal law enforcement, engaged outside cybersecurity experts, and sent notification letters to affected customers.
What Customers Should Do
- Watch card statements for unfamiliar charges and ask your issuer about replacing the card.
- Treat unexpected emails or texts referencing a Revolve order as potential phishing.
- Avoid storing payment cards in retailer accounts where a guest checkout or wallet token is available.
- Consider a credit freeze if you receive a notification letter.