Revolve Group said an unauthorized actor accessed certain company systems and may have obtained personal and payment-card information for some customers. The company says it contained the activity and has not experienced service interruptions or operational disruption.
- Information potentially affected: Revolve believes the actor may have obtained, through automated means, the names, contact details, payment-card numbers and card expiration dates of certain customers who had saved payment information to their online shopping accounts.
- Response: The company activated its incident-response procedures, remediated the unauthorized activity and is assessing the incident’s scope. It has engaged external cybersecurity specialists, notified federal law enforcement and implemented additional security measures intended to prevent a similar event.
- Business impact: Revolve said the incident has not interrupted customer service and, as of October 29, did not appear likely to have a material impact on its business.
The company’s assessment is ongoing, so the number of affected customers and the full scope of the incident were not specified. Revolve also cited potential legal, regulatory, reputational and financial risks associated with the incident.