Online fashion retailer Revolve has told regulators in Indiana that a cyberattack on its systems in September affected 1,515,073 people, in what is now one of the largest retail payment-data breaches of the year.

The company, which runs Revolve.com and FWRD.com, first disclosed the incident on 29 October in a filing with the US Securities and Exchange Commission. The new figure, reported on 9 November, is far higher than the roughly 197,000 people covered by earlier notices filed in Iowa, Massachusetts, South Carolina, Texas and Vermont.

What happened

According to the filings, an unauthorised party gained access to some of Revolve's systems, including its e-commerce platform, on 11 September 2026. The company discovered the intrusion on 29 September and began notifying affected customers around the time of its October disclosure.

Revolve said the attacker may have obtained the data "through automated means". It has not explained how the attackers first got in, and no hacking group has publicly claimed responsibility for the attack.

The company reported the incident to federal law enforcement and brought in outside cybersecurity experts to investigate. It said the breach caused no operational disruption and that it did not expect the incident to have a material impact on its business.

What data was taken

The exposure is limited to customers who chose to save a payment method in their Revolve online account. For those customers, the data that may have been taken includes names, contact details and mailing addresses, along with payment card numbers and card expiry dates.

The filings do not mention card security codes, the three-digit numbers printed on the back of a card, and Revolve has not said that any such codes were exposed. Social Security numbers were also not listed among the data involved.

State filings give a picture of how the total built up. Texas alone listed 127,200 affected residents, and Massachusetts listed 46,813. The Indiana attorney general's year-to-date breach report is the first record to carry a company-wide total, listing 1,515,073 people affected, including 10,534 Indiana residents.

What customers should do

Anyone who saved a card on Revolve or FWRD should check their card statements closely for unfamiliar charges and consider asking their bank for a replacement card, since the exposed card numbers and expiry dates could be used for fraudulent purchases.

Customers should also be wary of phishing messages. Attackers who hold names, addresses and partial payment details sometimes use them to send convincing emails or texts that appear to come from a retailer or a bank. Revolve customers who receive an unexpected message asking them to confirm payment details should contact their bank directly rather than clicking a link.

The incident is a reminder of the risk that comes with storing payment details online. Saved cards make checkout faster, but they also mean a single breach can expose payment data for more than a million shoppers at once.