Online fashion retailer Revolve Group told the Securities and Exchange Commission (SEC) that an intruder may have taken payment card numbers that customers had saved in their shopping accounts, and a filing with Texas regulators lists about 127,200 affected residents of that state, The Record reported Friday. The case shows the risk retailers carry when they keep card details on file for faster checkout.
What Happened
In a Form 8-K dated Oct. 29, Revolve said it recently learned of unauthorized access to certain of its systems. Its investigation so far indicates that an unauthorized actor may have used "automated means" to obtain names, contact information, payment card numbers and expiration dates of customers who saved payment details in their online accounts.
The company said it activated its incident response plan, confirmed the unauthorized activity was remediated, brought in outside cybersecurity experts and notified federal law enforcement. It reported no disruption to operations.
The filing does not say when the access occurred or how many customers were affected. The Record reported that Revolve told Texas regulators Friday that 127,200 Texans were affected and reported 1,328 victims in Vermont. It also filed a notice in Massachusetts without a count. Revolve did not answer The Record's question about when the attack happened.
Why It Matters
Revolve filed under Item 8.01, the SEC's catch-all for other events, rather than Item 1.05, which the SEC requires for cyber incidents a company judges material to its business. The filing says Revolve does not believe the incident will have a material impact, while noting that it is still assessing the scope and the legal, regulatory and reputational risks. Investors watch that choice as a signal of how seriously a company rates a breach.
Merchants that store card numbers must meet the Payment Card Industry Data Security Standard (PCI DSS), the card networks' security rules, and a theft of stored cards can bring scrutiny from card networks and banks as well as regulators. Revolve has not said how the automated access worked; such tools can be used to test stolen passwords against shopping accounts at scale, though the company has not said that happened here.
What to Watch
Look for a total victim count as more state notices are filed, an explanation of how the intruder got in and when, and any follow-up from card networks or regulators. Customers who saved cards with Revolve should check statements for charges they do not recognize.
