Online fashion retailer Revolve Group says criminals stole the payment card numbers and expiration dates that customers had saved in their Revolve accounts, along with their names and addresses. A record on the Texas attorney general's breach portal suggests the total could reach about 1.5 million people, though the company itself has not confirmed a number.
The figure comes from Malwarebytes, which found 1,515,073 labelled as the total number of affected people in data returned by the Texas site when searching for Revolve. That number is not displayed on the public listing, which shows only 127,200 affected Texans.
Only customers with saved cards were hit
According to Revolve's customer notification letter, filed with the Massachusetts attorney general, the breach affected only people who had stored a payment card as a payment method in their account. The exposed data covers names, contact details, card numbers and card expiration dates.
Several questions remain open. Revolve's SEC filing does not mention card verification values (CVVs), the three- or four-digit security codes used for online purchases, and it is unclear whether card numbers were stored in full or masked, or whether Revolve or a third-party payment processor held them. Malwarebytes cautions that a card number and expiry date can be enough to make purchases at some online stores, and that criminals who hold real card details can write far more convincing phishing messages aimed at extracting the missing code.
"Automated means" and a two-week gap
Revolve has not said how the attacker reached the saved payment data. In its SEC filing the company said it believes an unauthorized actor may have obtained the data "through automated means". Records on the Texas attorney general's site put the incident on September 11 and its discovery on September 29. No group has publicly claimed the theft, and Revolve says it has taken additional security measures without describing them.
Cancel and reissue the card if you saved it
- If you had a card saved in a Revolve account, ask your issuer to cancel it and send a replacement with a new number, which makes the stolen one useless.
- Until then, read statements line by line. Small test charges and unfamiliar merchant names are a common first sign of misuse.
- Report unauthorized charges to the issuer immediately.
- Treat calls, texts and emails about the breach with suspicion. If someone claims to be your bank, hang up and call the number printed on your card.
- Consider removing saved cards from shopping accounts altogether.
Saved cards are a convenience that shifts risk onto the shopper: one breach at one retailer turns a checkout shortcut into a card that has to be replaced. More breach coverage affecting American organizations is on our United States profile.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.