Revolve Group, the US online fashion retailer, said in a Form 8-K dated 29 October 2026 and filed with the US Securities and Exchange Commission on 30 October that it recently became aware of unauthorised access to certain of its systems, started its cyber incident response protocols and confirmed the unauthorised activity was remediated.

Revolve says that, based on its investigation, an unauthorised actor may have obtained, through automated means, the name, contact information, payment card number and payment card expiration date for certain customers who saved payment information with their online shopping account on its e-commerce platform.

It says it notified federal law enforcement, engaged external cybersecurity experts, that the incident has not caused operational disruption or interrupted service to customers, and that it does not believe the incident will have a material impact on its business. Revolve did not say when the access happened or how many customers are affected.

According to The Record, Revolve did not answer its questions about when the attack occurred, and told regulators in Texas that 127,200 people in the state had information stolen, with another 1,328 in Vermont and notifications also filed in Massachusetts (state filing figures as reported by The Record, not independently verified). (sources: Revolve Form 8-K; The Record)