Revolve Group Says Saved Payment Card Data May Have Been Stolen in Data Breach - Oui Speak Fashion (OSF)

Revolve Group, the operator of fashion e-commerce sites REVOLVE and FWRD, disclosed in a Form 8-K filed with the U.S. Securities and Exchange Commission on October 29 that an unauthorized actor may have obtained customer data. The company has begun notifying affected customers whose names, contact information, payment card numbers and expiration dates were potentially compromised.

The incident occurred on September 11 and was discovered by the company on September 29. Revolve promptly initiated its cyber incident response protocols and confirmed the unauthorized activity was remediated. The company has not disclosed how many customers were affected in total, but state filings offer some indication of scale.

Data Accessed Through Automated Means

Based on its investigation, Revolve believes the data was obtained through automated means from customers who saved payment information to their online shopping accounts. The customer notification letter filed with the Massachusetts Attorney General specifies that the affected data includes the customer's name and address along with the number and expiration date of the card on file.

State Filings Indicate Scale

The Texas Attorney General's data breach reporting site lists 127,200 affected Texans. Security company Malwarebytes reported that data returned by the Texas site included a figure of 1,515,073 labeled as the total number of people affected, though this number does not appear on the public listing and Revolve has not confirmed it.

Business Impact and Customer Response

Revolve stated the incident did not cause operational disruption or interrupt service to customers. The company does not expect a material impact on its business, though it flagged potential legal, regulatory, reputational and financial risks that could arise as its assessment continues.

In its customer notification letter, Revolve advised reviewing payment card statements and immediately reporting any unauthorized charges to the card issuer. The company set up a call center for questions but did not mention complimentary credit monitoring services.

Recent Company Developments

The disclosure comes during an active period for Revolve Group. In October, the company appointed former NBA player Dwyane Wade as chief performance officer to build on momentum in its men's business. It also expanded Kendall Jenner's role to global creative director of FWRD and opened a new REVOLVE store at Aventura Mall in Florida.

Earlier in the fall, Revolve announced a joint venture with fashion designer Donatella Versace. The company continues to balance the convenience of saved payment methods against the security risks they present, with how much more Revolve discloses about the incident likely shaping how customers and investors judge its response.