Revolve says an actor may have obtained saved card numbers and expiry dates; Texas lists 127,200 people

127,200 Texans listed, no total in the 8 K: what Revolve's filings establish

The Texas Attorney General's data security breach report listing shows Revolve Group, Inc. with 127,200 Texans affected, published on 30 October 2026. The Form 8 K that Revolve Group, Inc. signed on 29 October 2026 gives no number of customers at all. The Texas figure is dated one day after the filing's date of report (derived), and it is the only count of people in anything this briefing could read from a primary record. Revolve is the sole source of every fact about the incident: the 8 K and the state report are its own statements, made under a duty to disclose, and no outside party has confirmed any detail.

What that count does not establish is a total. The listing is one state. The 8 K says the data belongs to "certain customers", not to all of them, and it gives no attack window, no entry route and no word on whether any card was used. The filing's verb is hedged: the actor "may have obtained" the data. The press version that circulated on 30 October is firmer than the filing in several places, and the next section sets the two side by side.

This briefing rests on the 8 K, read in full (between about 22:41 and 22:47 UTC on 30 October 2026, three pages, Item 8.01), the Texas listing row, read in a browser tab at about 22:43 UTC the same evening, and one news report, The Record's article of 30 October 2026, which is secondary and is used as a pointer. Four things were not available to this briefing: the same filing on the SEC's own site (the host refused the request), the Massachusetts notice that The Record links (the host refused the request), Revolve's second quarter results page (it sat behind a bot check), and a Vermont entry. The Vermont Attorney General's notice list, as read, had no entry dated after 10 April 2026, so the Vermont count below rests on The Record alone. Anything that depends on those four is marked.

The filing says "may have obtained"; the headlines say hackers stole

The company's own paragraph is short and carefully hedged. It says Revolve "recently became aware of unauthorized access to certain of its systems", that it "confirmed the unauthorized activity was remediated", and that it "believes that an unauthorized actor may have obtained, through automated means" four named data fields for "certain customers who saved payment information associated with their online shopping account". The full paragraph is in the Technical details section as printed. The company is the sole source, and what it chose to put in an 8 K is a statement to investors, not an incident report.

This briefing follows the filing. Some headlines write the company's name as Resolve; the registrant on the 8 K is Revolve Group, Inc. The Record also gives a founding year and a quarterly sales figure for the company; neither is in the filing, and Revolve's results page could not be read, so neither is used here.

One more point is about the form. Revolve filed under Item 8.01, Other Events. The SEC's cybersecurity rule, as published in the Federal Register, created a separate Item 1.05 for incidents a company has determined to be material, and it asks the company to "describe the material aspects of the nature, scope, and timing of the incident". The Revolve 8 K cites no Item 1.05, and says the company does not believe the incident will have a material impact. That is consistent with the filing giving no timing and no count. Whether any rule required more is a legal question this briefing does not answer, and the company's statement is a belief as of its date. It does mean that the nature, scope and timing a reader might expect from an 8 K about a cyber incident are not promised by this one.

Four fields named, and the questions the list leaves open

The filing names four fields: "the name, contact information, payment card number and payment card expiration date". The Texas listing, which is Revolve's own report to that state, ticks two of the state's categories: "Name of individual" and "Financial Information (e.g. account number, credit or debit card number)". The state's list of categories is the state's, so the absence of a category for contact details is not a contradiction; it is a reason not to read the two lists as one.

Zoom

Several fields a reader will ask about are simply absent from the filing: a card security code, a password, order history, a billing address as such, a date of birth. Absent is not the same as safe. A company's list says what the company chose to name, and "contact information" is not itemised. Two questions matter for a customer and neither is answered. First, whether "payment card number" means the whole number or a masked one; the filing does not say "last four digits" or any other qualifier. Second, who holds the saved numbers. The filing ties the data to a "saved payment information" feature on the company's online store platform. It does not say whether the numbers sit in Revolve's own systems or with a payment processor, and this briefing does not infer it.

This briefing did not research which merchants will accept a number and an expiry date without a security code, so it does not say how readily the named fields could be used. It says only that a card number and an expiry date are the details that identify a card to its issuer, which is general practice and not a finding, and which is why replacing the card is the first item on the list below.

What "automated means" tells you, and what it does not

The phrase appears once, in the sentence that names the data. It says the actor "may have obtained, through automated means". Read plainly, it says software did the collecting. It does not say how fast, how much or for how long. It does not name the weakness, the route in, the number of requests, or whether a customer account was signed in to. The filing does not say credential stuffing, a skimmer on the checkout page or a flaw in the platform, and this briefing does not say any of them either.

The OWASP Automated Threats project makes a point that helps here: unwanted automated activity is often "misuse of inherent valid functionality, rather than the attempted exploitation of unmitigated vulnerabilities". That is the project's general description and not a statement about Revolve. It matters because it separates two readings of "automated": a script abusing a feature that works as designed, and a script exploiting a bug. The 8 K does not choose between them.

The filing says the unauthorized activity was "remediated" and that enhanced security measures were put in place. Those words describe the company's response, and they say nothing about whether the data that may have been obtained is still usable. A card number does not become safe when a hole is closed.

The counts by state, and the gap to the unknown total

Three states are named in what was read, and only one count was read from a primary record. The Texas listing reads: Revolve Group, Inc., Cerritos, California; types of information "Name of individual" and "Financial Information"; 127,200 Texans; notice provided, yes; method "Posted at company website or special website" and "U.S. Mail"; date published 10/30/2026. The page carries a warning that the number "may change after a report is listed here". The Record says Vermont has 1,328 and that notices were filed in Massachusetts.

Zoom

Two cautions follow. First, 128,528 is the sum of two counts from two different kinds of source, and it covers two states. It is not a total, and a Texas figure that is 99.0 per cent of the two (derived) says nothing about how the remaining customers are spread, because the 8 K gives no rule for which customers are in scope. Second, the Texas listing was published on a Friday, which matches The Record's "on Friday", but the listing's date is the date the state published it, not necessarily the date Revolve reported. The listing also says notice has been provided, by mail and a website posting. That suggests, as inference, that Revolve holds postal addresses for at least some of the 127,200 and that letters have gone out or were going out; it does not say when.

The gap between a company filing and a state listing is not new. Another briefing on this site, on iRhythm, sets a company's 8 K beside regulator listings in the same way.

Friendly labels in the filing, and what each does not do

Several phrases in the 8 K read as reassurance. Each describes something real, and none is a control that protects a customer's card.

What to do, in the order worth doing

Nothing in the filings advises customers or operators. Every item below is this site's guidance, built from the data fields the 8 K names and from general practice. The order is a judgement: it puts first what makes a stolen number or expiry date least useful.

The records read publish no indicator, no software name and no detection rule, so there is nothing to search for in logs from the filings alone. The hunting advice is behavioural, and it is this site's, not the company's.

Technical details

Neither primary record prints an indicator of compromise, a log line, a configuration, a software name or version, a vulnerability identifier or a payload, and the 8 K names no product, system or vendor. So there is nothing technical to hunt for from the filings, and none has been invented here. What the records do print is below, copied exactly as read, so that the wording in this briefing can be checked against it.

Revolve Group, Inc. (the "Company") recently became aware of unauthorized access to certain of its systems. The Company promptly initiated its cyber incident response protocols and confirmed the unauthorized activity was remediated. The Company proceeded to assess and investigate the scope of the incident and to identify and implement enhanced security measures designed to prevent a similar event from occurring. The Company also notified federal law enforcement authorities and engaged leading external cybersecurity experts to assist with the investigation and response efforts.

Based on its investigation, the Company believes that an unauthorized actor may have obtained, through automated means, the name, contact information, payment card number and payment card expiration date for certain customers who saved payment information associated with their online shopping account on the Company's e-commerce platform.

This incident has not resulted in operational disruption or interrupted service to any customers, and as of the date of this report, the Company does not believe this incident will have a material impact on its business.

Entity or Individual Name: Revolve Group, Inc.
Entity or Individual Address: 12889 Moore St.
Entity or Individual City: Cerritos
Entity or Individual State: California
Entity or Individual Zip Code: 90703
Type(s) of Information Affected: Name of individual;Financial Information (e.g. account number, credit or debit card number)
Number of Texans Affected: 127200
Notice Provided to Consumers (Y/N): Yes
Method(s) of Notice to Consumers: Posted at company website or special website;U.S. Mail
Date Published at OAG Website: 10/30/2026

Item 1.05 Material Cybersecurity Incidents (a) If the registrant experiences a cybersecurity incident that is determined by the registrant to be material, describe the material aspects of the nature, scope, and timing of the incident, and the material impact or reasonably likely material impact on the registrant, including its financial condition and results of operations.

The question that exposes the gap

The record is an 8 K that says an actor may have obtained four fields through automated means, a state listing that puts 127,200 Texans on the notice list, and no total, no window and no route. If a script asked your account pages for every saved card tonight, which control would say no, and how many requests would it take before anyone on your team noticed?

Key facts