HackingRetail & ConsumerRetailCustomer Data InvolvedIdentity (basic)Financial accountLowContained

REVOLVE GROUP, INC.

bd_cb6bdb4e5bd506ce · schema v1 · pii pii-v2

Severity

Low

Discovered

—

Filed

Oct 29, 2026

To disclose

—

Affected

Not disclosed

Linked

4 filings

Confidence

68%

Full breach record for REVOLVE GROUP, INC. →

Revolve Group, Inc. notified customers of a data security incident involving its online shopping platform. On September 11, 2026, an unauthorized actor accessed the platform. The company determined that customer name, address, payment card number, and expiration date were involved. The company contained the activity, notified law enforcement, and is enhancing system security.

J jump to incidentP pin to compareR raw source

Incident timeline

Sep 11, 2026

Begins

Oct 29, 2026

Filed

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Vermont State AGbd_706ce85eed4c11ab2026-10-29Candidate
Iowa State AGbd_c811f1a9affdc4542026-10-29Verified
Texas State AGbd_ca1c80187536853b2026-10-30 · +1dVerified

Name: REVOLVE GROUP, INC.
norm: revolve group

Name: REVOLVE GROUP, INC.
norm: revolve group
Industry: Retail & Consumerllm

Discovered: —
Breach occurred: Sep 11, 2026
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Implemented measures to contain the activity
Began the investigation
Notified law enforcement
Changes made: Taken measures to enhance the security of our systems to help prevent something like this from happening in the future
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Vermont State AGOct 29 · first

Iowa State AGOct 29 · first

Delaware State AGOct 29 · first · this page

Texas State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2026/10/Revolve-Delaware-Attachment.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 29, 2026
Raw hash: b7a916b91a9a9f35f039ceb93dd66ef34f14067f95cb2436f322db5ac7b3d675

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityREVOLVE GROUP, INC.

Victim entityREVOLVE GROUP, INC.

IncidentUnauthorized Access

Stated responseImplemented measures to contain the activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov