Revolve Group, Inc. disclosed a data security incident affecting customer accounts on its online retail platforms, including Revolve and FWRD. Unauthorized activity began on September 11, 2026, and was discovered by the company on September 29, 2026. The retailer submitted disclosures to multiple state attorneys general and filed a Form 8-K with the Securities and Exchange Commission on October 29, 2026, the same day it began issuing notifications to affected consumers.
The incident compromised customer names, mailing addresses and contact details, payment card numbers, card expiration dates, and financial account codes for users with saved payment information. Filings with the Texas Attorney General report that 1,515,073 individuals were affected overall, including 127,200 residents in Texas, 46,813 in Massachusetts, 17,813 in South Carolina, 3,918 in Iowa, and 1,328 in Vermont. Social Security numbers and medical records were not reported involved.
Investigations into unauthorized access incidents often reveal additional details over time. Notice submissions to state regulators and customer notifications may continue as forensic reviews proceed.