[Single source] Revolve puts data breach victim count at 1.5 million

Online fashion retailer Revolve has told regulators that a September cyberattack affected more than 1.5 million individuals, according to a SecurityWeek report published in November 2026.[1]Revolve Puts Data Breach Victim Count at 1.5 Millionsecurityweek.com · rssOpen original sourceSee in source list

Revolve disclosed to regulators that the cyberattack it suffered in September affected more than 1.5 million people, putting a concrete figure on the incident's scale through an official notification.[1]Revolve Puts Data Breach Victim Count at 1.5 Millionsecurityweek.com · rssOpen original sourceSee in source list

This regulatory disclosure is the only concrete development available in the current evidence batch; the report does not describe the attack method, the types of data involved, or any attribution to a threat actor.[1]Revolve Puts Data Breach Victim Count at 1.5 Millionsecurityweek.com · rssOpen original sourceSee in source list

A victim count above 1.5 million individuals positions this as a large-scale data exposure at a major e-commerce retailer, relevant to a substantial population of online shoppers.[1]Revolve Puts Data Breach Victim Count at 1.5 Millionsecurityweek.com · rssOpen original sourceSee in source list

The fact that the number surfaced through a regulator notification, rather than a voluntary public statement, indicates formal breach-reporting obligations are now shaping what is known about the incident.[1]Revolve Puts Data Breach Victim Count at 1.5 Millionsecurityweek.com · rssOpen original sourceSee in source list

The provided evidence contains no guidance from Revolve or regulators on steps affected individuals should take, such as credit monitoring or password resets.[1]Revolve Puts Data Breach Victim Count at 1.5 Millionsecurityweek.com · rssOpen original sourceSee in source list

As a general precaution inferred from the scale of the incident, individuals who have shopped with the retailer may watch for direct notification from Revolve and treat any follow-up communications with scrutiny.[1]Revolve Puts Data Breach Victim Count at 1.5 Millionsecurityweek.com · rssOpen original sourceSee in source list

Known at this point: the victim is online fashion retailer Revolve; the incident was a cyberattack that occurred in September; the company reported to regulators that more than 1.5 million individuals were affected.[1]Revolve Puts Data Breach Victim Count at 1.5 Millionsecurityweek.com · rssOpen original sourceSee in source list

Unknown from the current evidence: what data was exposed, how the attackers got in, whether ransom or extortion was involved, who is responsible, and whether the 1.5 million figure will be revised.[1]Revolve Puts Data Breach Victim Count at 1.5 Millionsecurityweek.com · rssOpen original sourceSee in source list

No statements from Revolve executives, regulators, attackers, or affected customers appear in the evidence batch; the only voice present is SecurityWeek's reporting on the regulatory filing.[1]Revolve Puts Data Breach Victim Count at 1.5 Millionsecurityweek.com · rssOpen original sourceSee in source list

The evidence batch contains a single data point with no earlier disclosures, follow-up reports, or updates on remediation, investigation, or litigation.[1]Revolve Puts Data Breach Victim Count at 1.5 Millionsecurityweek.com · rssOpen original sourceSee in source list

The publication of a concrete victim count suggests the incident has progressed from initial detection to formal regulatory reporting, roughly two months after the September attack.[1]Revolve Puts Data Breach Victim Count at 1.5 Millionsecurityweek.com · rssOpen original sourceSee in source list

1 independent groups, 1 updates, and 0 engagements.[1]Revolve Puts Data Breach Victim Count at 1.5 Millionsecurityweek.com · rssOpen original sourceSee in source list

The report characterizes the incident only as a cyberattack that occurred in September; no technical details such as attack vector, malware families, ransomware involvement, or categories of data exposed are provided in the evidence.[1]Revolve Puts Data Breach Victim Count at 1.5 Millionsecurityweek.com · rssOpen original sourceSee in source list

This news item rests on a single primary source: SecurityWeek's article "Revolve Puts Data Breach Victim Count at 1.5 Million," delivered via RSS and published around November 9, 2026.[1]Revolve Puts Data Breach Victim Count at 1.5 Millionsecurityweek.com · rssOpen original sourceSee in source list

The 1.5 million figure originates from Revolve's own statement to regulators as relayed by SecurityWeek; it has not been corroborated by an independent source or the regulator itself within this evidence batch.[1]Revolve Puts Data Breach Victim Count at 1.5 Millionsecurityweek.com · rssOpen original sourceSee in source list