Recent cyber attacks and data breaches

Central Ohio Primary Care Physicians, Inc. (COPC) notified the California Attorney General of a data breach on October 30, 2026, with the breach dated August 17, 2026. The notice covers more than 500 California residents; California does not publish the exact number.

NCH Corporation notified the California Attorney General of a data breach on October 30, 2026, with the breach dated January 21, 2026. The notice covers more than 500 California residents; California does not publish the exact number.

The Nueva School notified the California Attorney General of a data breach on October 30, 2026, with the breach dated June 13, 2026. The notice covers more than 500 California residents; California does not publish the exact number.

El Camino Health notified the California Attorney General of a data breach on October 30, 2026, with the breach dated August 26, 2026. The notice covers more than 500 California residents; California does not publish the exact number.

Baanx US Corp. notified the California Attorney General of a data breach on October 30, 2026, with the breach dated September 23, 2026. The notice covers more than 500 California residents; California does not publish the exact number.

EyeMed Vision Care, LLC notified the California Attorney General of a data breach on October 30, 2026, with the breach dated September 22, 2026. The notice covers more than 500 California residents; California does not publish the exact number.

Revolve Group, Inc. (the "Company") recently became aware of unauthorized access to certain of its systems. The Company promptly initiated its cyber incident response protocols and confirmed the unauthorized activity was remediated. The Company proceeded to assess and investigate the scope of the incident and to identify and implement enhanced security measures designed to prevent a similar event from occurring. The Company also notified federal law enforcement authorities and engaged leading external cybersecurity experts to assist with the investigation and response efforts. Based on its investigation, the Company believes that an unauthorized actor may have obtained, through automated means, the name, contact information, payment card number and payment card expiration date for certain customers who saved payment information associated with their online shopping account on the Company's e-commerce platform. This incident has not resulted in operational disruption or interrupted service to any customers, and as of the date of this report, the Company does not believe this incident will have a material impact on its business. Cautionary Note Regarding Forward-Looking Statements This Current Report on Form 8-K contains "forward-looking statements" within the meaning of the safe harbor provisions of the U.S. Private Securities Litigation Reform Act of 1995. All statements other than statements of historical or current fact included in this Current Report on Form 8-K are forward-looking statements, including but not limited to statements regarding the Company's current beliefs, understanding and expectations regarding the cybersecurity incident discussed in this Current Report on Form 8-K and its impact on the Company's business. Forward-looking statements include statements containing words such as "expect," "anticipate," "believe," "project," "will" and similar expressions intended to identify forward-looking statements. These forward-looking statements are based on the Company's current expectations. Forward-looking statements involve risks and uncertainties. The Company's actual results could differ materially from those anticipated in such forward-looking statements as a result of these risks and uncertainties, which include, without limitation, risks related to the outcome of the Company's ongoing assessment of the incident and its ability to address the impact of this incident; legal, regulatory, reputational and financial risks resulting from this incident or additional incidents; and other risks and uncertainties included under the caption "Risk Factors" and elsewhere in the Company's filings with the Securities and Exchange Commission ("SEC"), including, without limitation, the Annual Report on Form 10-K for the year ended December 31, 2025, and subsequent Quarterly Reports on Form 10-Q, including for the quarter ended June 30, 2026, filed with the SEC on August 4, 2026. You are cautioned not to place undue reliance on these forward-looking statements, which speak only as of the date of this Current Report on Form 8-K. All forward-looking statements are qualified in their entirety by this cautionary statement, and the Company undertakes no obligation to revise or update any forward-looking statements to reflect events or circumstances after the date hereof.

HCA Healthcare, Inc. notified the California Attorney General of a data breach on October 29, 2026, with the breach dated August 12, 2026. The notice covers more than 500 California residents; California does not publish the exact number.

Blossom BH Opco Inc. notified the California Attorney General of a data breach on October 29, 2026. The notice covers more than 500 California residents; California does not publish the exact number.

Marathon Health notified the California Attorney General of a data breach on October 29, 2026, with the breach dated August 24, 2026. The notice covers more than 500 California residents; California does not publish the exact number.