Fashion retailer Resolve says hackers stole payment card information

Online fashion retailer Revolve warned investors that cybercriminals gained access to payment card numbers and expiration dates during a recent cyber incident. 

The clothing giant filed an 8-K report on Thursday with the Securities and Exchange Commission (SEC) saying hackers gained access to multiple company systems. 

Revolve did not respond to questions about when the attack occurred but said in the report that an initial investigation found that the threat actors used “automated means” to obtain names, contact information, payment card numbers and payment card expiration dates from customers who saved payment information in their online shopping account on Revolve’s e-commerce platform. 

Revolve said it has notified federal law enforcement agencies about the attack and has hired a cybersecurity firm to lead the recovery effort. There were no operational disruptions caused by the attack, and Revolve said it will not face material financial impacts as a result of the incident.

The company, which bills itself as “the next-generation fashion retailer for Millennial and Generation Z consumers,” did not say how many people were affected but told regulators in Texas on Friday that 127,200 people in the state had information stolen. Another 1,328 victims are in Vermont, and breach notifications were filed in Massachusetts.

Founded in 2023, Revolve has served as a fashion retailer for more than 1,600 brands. The company sells apparel, footwear and accessories — reporting $347.4 million in net sales in the last fiscal quarter. 

The payment card information held by fashion retailers continues to be a valued target for cybercriminals, with large brands like Asos, Levi Strauss, Foschini Group, Mango, North Face, Harrods, M&S and The Co-op all facing cyberattacks over the last two years.