Revolve confirms card data breach affected 1,515,073 people

Revolve now tells Indiana 1,515,073 people were hit in a September breach of stored card data; no group has claimed it.

Online fashion retailer Revolve says an unauthorized party entered some systems, including its e-commerce platform, on September 11 and that the company learned of it on September 29. According to an Indiana filing reported by SecurityWeek, 1,515,073 people were affected. Data that may have been collected by automated means include names, contacts, mailing addresses, and, for customers who stored a card, payment card numbers and expiration dates. Malwarebytes had earlier treated a 1,515,073 figure as an unconfirmed site field and cited 127,200 Texans; SecurityWeek says five other states’ notices covered roughly 197,000 people combined. No CVV exposure is mentioned, no group has claimed the theft, and Revolve has not explained the access method. It reported the attack to federal law enforcement and said it added security measures without describing them. An October 29 SEC filing gave no public victim total.