The Record reported that online fashion retailer Revolve warned investors of a cyber incident. In a filing with the US Securities and Exchange Commission on Thursday, Revolve said attackers got into several of its systems. An early review found they used automated tools to collect customer names, contact details, card numbers and card expiry dates. This only affected customers who had saved payment details in their online shopping accounts.
Revolve did not tell The Record when the attack happened. It has not given a total count of affected people. Filings with state regulators give partial numbers: 127,200 people in Texas and 1,328 in Vermont. Revolve also filed breach notices in Massachusetts. Revolve said it told federal law enforcement and hired a cybersecurity firm to lead recovery. It said the attack caused no operational disruption and that it does not expect a material financial impact.
Stored card data is a known target for attackers, and The Record notes that many large fashion brands have faced attacks in the past two years. For teams that run online shops, the case shows what saving customer cards in accounts can expose. Teams that buy or build checkout software may want to review what payment data their platforms keep.