Revolve and FWRD data breach investigation (saved payment cards, September 2026)

Revolve Group, the company behind the online fashion stores Revolve.com and FWRD.com, says an unauthorized actor got into its online shopping platform on September 11, 2026, and may have taken saved payment card details. Notices began going out on October 29, 2026.

The exposed information includes names, addresses, card numbers and card expiration dates for customers who saved a payment method in their online account. State filings reviewed by SecurityWeek show notices to at least 197,072 people in five states.

Several law firms say they are investigating possible class action claims. Class Action Pulse found no filed lawsuit as of November 3, 2026. There is no settlement, payment or claim form, and Revolve is not offering free credit monitoring.

Revolve Group, Inc. is a publicly traded fashion retailer based in Cerritos, California. Its notice letter says it operates Revolve.com and FWRD.com.

Affected customers are people who chose to save a payment card in a Revolve online shopping account, according to Revolve's notice to the Iowa Attorney General.

Investigating law firms include Cole & Van Note, which announced an investigation on October 30, 2026. Almeida Law Group says Dapeer Law and Emery Reddy have also announced investigations. Law firm announcements are advertising and do not mean a case has been filed.

Revolve's state notices were sent by its outside counsel, attorney Pierce T. Cox, according to the Iowa letter.

According to Revolve's notice letter and state filings:

• Revolve found unauthorized activity on its online shopping platform, took steps to contain it, began an investigation and notified law enforcement.
• The investigation showed that on September 11, 2026, an unauthorized actor accessed the platform and may have acquired customer information.
• On September 29, 2026, Revolve determined that the data included names and addresses plus card numbers and expiration dates. Each letter lists the last four digits of the affected card.
• Revolve began mailing notices on October 29, 2026, and set up a toll-free call center.

In an SEC filing dated October 29, 2026, Revolve said the actor may have obtained the data "through automated means" and that the information included contact details. It said it engaged outside cybersecurity experts and notified federal law enforcement.

State counts reported so far include 127,200 in Texas, 46,813 in Massachusetts, 3,918 in Iowa and 1,328 in Vermont. SecurityWeek's tally, which adds South Carolina, reaches at least 197,072. Revolve has not published a nationwide total.

Revolve says it "immediately implemented measures to contain" the activity and has taken and will continue to take steps "to enhance the security of its systems." In the SEC filing it said the incident did not disrupt operations or customer service and that it does not believe the incident will have a material impact on its business.

Investigating firms say affected customers may have claims over how Revolve protected their data. No customer has made those claims in court that Class Action Pulse could find, so there are no allegations from a filed complaint to report. Revolve has not publicly responded to the investigations.

No court is involved yet. No lawsuit has been found, no judge has ruled on anything and no class exists. If a case is filed, Revolve would get a chance to respond before any ruling.

There is no defined class. Based on the notice, a future case would most likely focus on:

• Notice recipients: People who received Revolve's October 2026 letter.
• Saved cards: Customers who stored a payment card in a Revolve or FWRD online account.
• Affected data: People whose name, address, card number and expiration date were involved.

Any class definition would be set by a complaint and approved by a court. A customer who never saved a card may not be affected, according to the notice.

1. Call your card issuer. Ask about a replacement card for the card ending in the digits listed in your letter.
2. Review statements. The notice says cardholders generally are not responsible for unauthorized charges reported promptly.
3. Remove saved cards you no longer want stored with online stores.
4. Watch for phishing. Thieves may use your name and address to send fake Revolve messages.
5. Keep your notice and records of fraud charges, card replacement costs or time spent.
6. Call Revolve's line at 888-517-6458, Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern, with questions.

Nothing is available now. Revolve is not offering free credit monitoring, according to SecurityWeek. In other payment card breach cases, settlements have sometimes repaid documented losses or time spent, but any benefit here would require a filed lawsuit and a court-approved settlement or judgment.

• September 11, 2026: Unauthorized access to Revolve's platform, according to the notice.
• September 29, 2026: Revolve identifies the data involved.
• October 29, 2026: Notices begin; SEC filing dated.
• October 30, 2026: Cole & Van Note announces an investigation.

Revolve's notice says payment card rules generally protect cardholders from unauthorized charges reported in a timely manner, so act soon. Free credit reports are available weekly at annualcreditreport.com.

• Data breach investigation: A law firm's review of whether to file a lawsuit. It is not a lawsuit.
• Saved payment method: A card stored in your online account for faster checkout.
• Form 8-K: A report public companies file with the SEC to disclose major events.
• Card-not-present fraud: Online or phone purchases made with stolen card numbers.
• Security freeze: A free block on new credit in your name at the credit bureaus.

Investigating firms may file a complaint, or may not. More state counts may also be posted, which could raise the known total. Class Action Pulse will update this page if a lawsuit is filed or Revolve releases new details.

This page relies on Revolve's notice letter and the Iowa Attorney General filing, the California Attorney General listing, Revolve's SEC filing as reproduced by StockTitan and The Record, SecurityWeek's tally of state filings, and law firm announcements. Texas, Massachusetts and South Carolina counts come from secondary reports of state filings. One law firm site cites a much higher Texas-reported total that Class Action Pulse could not confirm, so it is left out. How the access happened and who was behind it are unknown.

Class Action Pulse is not a law firm or settlement administrator and does not guarantee eligibility or payment. This article is general information, not legal advice.