Almeida Law Group is investigating a data breach at Revolve Group, Inc. The breach occurred on September 11th, 2026 and was discovered on September 29th, 2026. If you were affected, contact Almeida Law Group.
About Revolve Group, Inc.
Revolve Group, Inc. (NYSE: RVLV) is a publicly traded online fashion retailer founded in 2003 and headquartered in Cerritos, California. The company operates two e-commerce platforms — REVOLVE, focused on contemporary fashion, and FWRD, focused on luxury fashion — selling apparel, footwear, accessories, and beauty products primarily to Millennial and Generation Z consumers. Because customers can save payment card information in their online shopping accounts, a breach of Revolve’s systems carries direct financial risk for shoppers whose stored card data may have been exposed.
What Happened?
Revolve Group, Inc. was listed in a Texas Attorney General data security breach report. According to that filing, an unauthorized party gained access to certain Revolve systems on September 11th, 2026, and the company discovered the intrusion on September 29th, 2026. The breach affected a total of 1,515,073 individuals. The exposed information included customers’ names, contact information, payment card numbers, and payment card expiration dates — specifically for customers who had saved payment information in their online Revolve or FWRD accounts. CVV and security codes were not listed among the confirmed exposed data types. Consumers were notified by U.S. Mail and through a posting on the company’s website. Revolve also filed breach notices with regulators in Massachusetts, Iowa, and Vermont.
Revolve Group disclosed the incident in an SEC Form 8-K filing on October 29th, 2026, stating it had “recently became aware of unauthorized access to certain of its systems” and had promptly initiated cyber incident response protocols. The company notified federal law enforcement and engaged external cybersecurity experts. Revolve described the data as having been obtained “through automated means” but has not elaborated on what that entailed. The company stated the incident did not cause operational disruption and that it does not expect a material financial impact. No ransomware group has been credibly linked to this incident. As of October 30th, 2026, at least two law firms — Dapeer Law and Emery | Reddy — have publicly announced investigations into potential class action lawsuits related to this breach, and Class Action U is tracking the incident for potential litigation, though no class action complaint specific to this breach had been filed as of that date.
Key Facts at a Glance
- Company or Organization: Revolve Group, Inc.
- Industry: Online fashion retail / E-commerce
- Location: Cerritos, California
- Incident type: Unauthorized access to customer account and payment card data
- Date of breach: September 11th, 2026
- Date breach discovered: September 29th, 2026
- Date of consumer notification: October 29th, 2026
- Total persons affected: 1,515,073
- Litigation status: Class action investigations announced by Dapeer Law and Emery | Reddy; no complaint filed as of October 30th, 2026
- Source: Texas Attorney General data security breach report; Revolve Group SEC Form 8-K; Mallory.ai; Class Action U
What Should You Do?
If you received a notice from Revolve Group or believe your information may have been involved, act quickly to protect yourself. Monitor your payment card statements closely for any unauthorized charges and report suspicious activity to your card issuer immediately — request a new card number if needed. Place a fraud alert or credit freeze with the three major credit bureaus (Equifax, Experian, and TransUnion) to help prevent new accounts from being opened in your name. You can request your free credit reports at AnnualCreditReport.com to check for accounts or inquiries you do not recognize. If you experience identity theft or fraud, report it and get a personalized recovery plan at IdentityTheft.gov.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
