Revolve says attacker took names, addresses, card numbers and expiry dates of customers with saved cards; Texas AG listing shows 127,200 Texans
- Customers: if you had a card saved at Revolve or FWRD, watch for fraudulent card-not-present charges or ask your bank for a new card. The filing doesn't mention CVVs.
- Phishing risk: names, addresses and partial card context make convincing refund or verification lures. Revolve won't ask for your full card details by email.
- Not disclosed: how the attacker got in, whether the card numbers were stored in full or tokenized, and the confirmed total.
Sources: Revolve Group Form 8-K (Item 8.01, Oct 29, 2026) · Malwarebytes: Revolve card breach (on the Texas AG figures)