In this article
- Fashion retailer Revolve said customers’ payment card numbers and expiration dates were stolen
- Data at risk includes card numbers and expiration dates, customer names and addresses
- Affected customers should watch their statements and consider asking issuers for new cards
Online fashion retailer Revolve Group said customers’ payment card numbers and expiration dates were stolen. In its customer notification letter filed with the Massachusetts Attorney General, Revolve told recipients the incident involved their names, addresses, and payment card details.
What was stolen?
The at-risk data includes customer names and contact information, payment card numbers, and card expiration dates. The breach only affected customers who had saved their payment card as a payment method in their Revolve account.
A filing on the Texas attorney general data breach website lists 127,200 affected Texans, but not a nationwide total. We found the figure of 1,515,073 in data returned by the site when searching for Revolve. That data labels it as the total number of people affected, but the figure isn’t displayed on the public listing. Other sites have repeated it, though they appear to rely on the same Texas record. The SEC filing did not give a number of affected people, and Revolve has not confirmed the total.
Revolve’s SEC filing does not mention card verification value (CVV) numbers. These three-digit security codes printed on the back of payment cards (four digits on the front for American Express cards) are an extra layer of security for card-not-present transactions.
It is also unclear whether the card numbers were fully visible or masked, or whether Revolve or a third-party payment processor held them.
Even without a CVV, card numbers and expiration dates may be enough to make purchases at some online stores. And scammers who know your real card details and contact information may be able to send more convincing phishing messages to trick you into revealing your CVV.
How did they get the data?
Revolve has not said how the attackers accessed the saved payment data. In its SEC filing, Revolve said it believes an unauthorized actor may have obtained the data “through automated means.” Records on the Texas attorney general’s site indicate that the incident happened on September 11 and was discovered on September 29.
No group has publicly claimed responsibility for the theft.
What Revolve customers can do now
Revolve said it has taken extra security measures following the breach, although didn’t say what those are.
Breaches happen every day. Don’t be the last to know.
If you have saved payment information in your Revolve account, your details may have been among those stolen. Fraud can often begin within days of a breach. If you’re concerned about your card details being exposed:
- Read your statements line by line to identify even small charges that you don’t recognize. Criminals will often make a small charge using stolen card details to see if the card works.
- Look for unfamiliar merchant names on your statement.
- Report unauthorized charges to the card issuer immediately.
- Consider removing saved cards from shopping accounts. You could use a password manager instead, some of which will store autofill data for payment cards.
- Ask your card issuer to cancel your card and reissue with a new number so that the old number becomes unusable.
Also, don’t immediately trust calls, texts, or emails about the incident. Scammers can use stolen information to make themselves sound convincing. If someone claims to be calling from your card issuer, call the number printed on your card to check.
If you’re unsure about a message or link, check it with Malwarebytes Scam Guard.
Let’s face it, an incognito window can only do so much.
Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance.