Revolve breach impacts at least 180,000 customers
Hackers accessed Revolve's online shopping platform and stole customers' personal and payment card data. At least 180,000 people are affected. Customers should watch their statements and consider replacing their cards.
What happened
On September 11, intruders accessed Revolve systems, including its online shopping platform, and took names, addresses, and payment card numbers and expiration dates of customers who saved that data to their accounts. Revolve disclosed the incident to the SEC and law enforcement and has started notifying at least 179,259 people.
Why it matters
Customer personal and payment data is exposed to fraud and identity theft. Revolve says there was no operational disruption and no material financial impact, but it is not offering free credit monitoring, so the risk sits with customers.
What to do
Customers should review card statements, consider canceling the saved card, and watch for fraud. E-commerce teams should review how payment data stored in customer accounts is accessed and monitored.
For the technical team
- Affected
- Resolve, varejista de moda que se autodescreve como voltada aos consumidores das gerações Y e Z; números de cartões de p · Customers who saved name, address, payment card number, and card expiration date to their account on Revolve's e-commerce platform.
- Exploitation
- Access and exfiltration reported by Revolve itself in an SEC 8-K filing; SecurityWeek says the hackers "may have accessed and exfiltrated" the data. Attackers and method have not been disclosed.
- Fix
- No fix applicable. Revolve says it initiated incident response and contained and remediated the unauthorized activity.
- Vector
- Unauthorized access to multiple company systems, including the e-commerce platform, on September 11 (SecurityWeek). Revolve's initial investigation found the threat actors used "automated means" to collect data saved in customer accounts (The Record, based on the 8-K report).
- More details
- Notices cited by The Record: 127,200 victims in Texas and 1,328 in Vermont, with breach notifications also filed in Massachusetts. SecurityWeek counts at least 179,259 notification letters, based on filings with attorney general offices in Iowa, Massachusetts, Texas, and Vermont. Revolve notified federal law enforcement, hired a cybersecurity firm, and is not offering free credit monitoring.
Timeline
SecurityWeek reports the breach impacts at least 180,000 people.
Incident opened.
Sources 2 sources
- Fashion retailer Resolve says hackers stole payment card information The Record
- Revolve Data Breach Impacts at Least 180,000 People SecurityWeek
