---
title: Revolve says attacker took names, addresses, card numbers and expiry dates of customers with saved cards; Texas AG listing shows 127,200 Texans | ctxsec
url: https://ctxsec.com/items/revolve-saved-payment-cards-stolen-8-k-texas-ag-filing
description: "In an SEC 8-K, online fashion retailer Revolve Group said an unauthorized actor may have obtained, \"through automated means,\" the name, contact information, payment card number and expiration date of customers who saved a card in their online shopping account. Revolve says it remediated the activity, notified federal law enforcement and doesn't expect a material impact. The Texas AG breach listing shows 127,200 affected Texans, with the breach dated Sept 11 and discovered Sept 29. A total of 1,515,073 appears in the Texas record's underlying data but isn't shown on the public page, and Revolve hasn't confirmed that number."
status: "official (Revolve Group SEC 8-K, Oct 29); victim counts from state AG filings"
published: 2026-11-04
---

> In an SEC 8-K, online fashion retailer Revolve Group said an unauthorized actor may have obtained, "through automated means," the name, contact information, payment card number and expiration date of customers who saved a card in their online shopping account. Revolve says it remediated the activity, notified federal law enforcement and doesn't expect a material impact. The Texas AG breach listing shows 127,200 affected Texans, with the breach dated Sept 11 and discovered Sept 29. A total of 1,515,073 appears in the Texas record's underlying data but isn't shown on the public page, and Revolve hasn't confirmed that number.

[← Cybersecurity News](/news) · [markdown](/items/revolve-saved-payment-cards-stolen-8-k-texas-ag-filing.md)

official (Revolve Group SEC 8-K, Oct 29); victim counts from state AG filings

2026-11-04

### Revolve says attacker took names, addresses, card numbers and expiry dates of customers with saved cards; Texas AG listing shows 127,200 Texans

- **Customers:** if you had a card saved at Revolve or FWRD, watch for fraudulent card-not-present charges or ask your bank for a new card. The filing doesn't mention CVVs.
- **Phishing risk:** names, addresses and partial card context make convincing refund or verification lures. Revolve won't ask for your full card details by email.
- **Not disclosed:** how the attacker got in, whether the card numbers were stored in full or tokenized, and the confirmed total.

Sources: [Revolve Group Form 8-K (Item 8.01, Oct 29, 2026)](https://www.sec.gov/Archives/edgar/data/1746618/000119312526439022/rvlv-20261029.htm) · [Malwarebytes: Revolve card breach (on the Texas AG figures)](https://www.malwarebytes.com/blog/data-breaches/2026/11/revolve-card-breach-1-5-million-people-may-be-affected)