Revolve account hacked? Here’s what to do
Move fast and in the right order: reclaim the account through Revolve’s official flow, kick the attacker out of every session, then close the door they came through — usually a password that leaked in a breach and was reused.
Revolve lost saved payment cards in a September 2026 breach. Check your card before you check your password
Revolve told the SEC on 29 October 2026 that attackers got into several of its systems, including the online shop, and used automated means to take the names, contact details, card numbers and expiry dates of customers who had a card saved in their account. Letters to customers started going out the same week. If you ever saved a card at Revolve, call the number on the back of it and ask for a replacement, then read your last two months of statements line by line. Revolve is not offering free credit monitoring, and no legitimate notice will ask you to confirm your card number by email or text.
Revolve’s SEC filing of 29 October 2026 and state attorney general notices, as reported by The Record (30 October), SecurityWeek (2–3 November) and Malwarebytes (3 November 2026).
If your Revolve account was hacked: start recovery at the official page (www.revolve.com/contactus), change the password to a unique one, sign out all other sessions, and re-check the recovery email and phone on the account. Then find out how the attacker got in — check whether your password appears in known breach data — and turn on two-factor authentication so it can’t happen again.
Recover your Revolve account, step by step
These steps follow Revolve’s official process — expect it to take a replacement card usually arrives within a week; disputed charges are typically settled by the issuer within one or two billing cycles. Official links only: account recovery.
Call the number on the back of any card you ever saved at Revolve, say it was exposed in the Revolve breach, and ask for a new card number. Most issuers do this for free.
Read the last two to three months of statements for that card. Dispute every charge you do not recognise with the issuer, including small test charges, and turn on transaction alerts in your banking app.
Sign in at revolve.com by typing the address yourself, check your order history and saved addresses, and remove the old card from your account. Set a new, unique password if you reused the old one anywhere.
Treat any email, text or call about the breach as suspicious. Check notices by contacting Revolve customer service through revolve.com, and do not give a card number, code or password to anyone who contacted you first.
If you got a notice letter, keep it. It is your proof for a class-action claim later, and it lists the contact details for the credit bureaus if you want to place a fraud alert.
What trips people up with Revolve
- The stolen data is a card, not a login. Changing your Revolve password does nothing for a card number that is already in someone else’s hands, so the first call goes to your bank or card issuer, not to Revolve.
- Card thieves often test a stolen number with a charge of a dollar or two before spending more. A small charge from a merchant you do not recognise is the early warning, so dispute it rather than shrugging it off.
- Names, postal addresses and card details together make a convincing phishing kit. Expect emails and texts dressed as Revolve “refund” or “card verification” notices, and never enter a card number from a link in one of them.
- The card you saved at Revolve may also be saved at FWRD, Revolve’s sister store, and at other shops. Once the issuer sends a replacement, update it only in the accounts you actually use and delete it everywhere else.
Was Revolve hacked? What happened in September 2026
Yes. In a filing with the Securities and Exchange Commission on 29 October 2026, Revolve Group said an unauthorised party accessed several company systems, including its online shopping platform, and took payment details that customers had saved to their accounts. According to the notice filed in Texas, the access happened on 11 September 2026 and Revolve found it on 29 September. The company says it hired a cybersecurity firm, contained the activity and told federal law enforcement. It has not said how the attackers got in, and no group has claimed the attack.
What was taken: names, contact details including postal addresses, payment card numbers and expiry dates. The filing does not mention the three-digit security code (CVV), and Revolve has not said whether the card numbers were stored in full or masked. Passwords are not mentioned either. Only customers who had saved a card are affected, so a shopper who typed card details in at checkout each time should not be in this group.
How many people: Revolve has not published a total. Notices filed with the attorneys general of Texas (127,200 people), Massachusetts, Iowa, South Carolina and Vermont add up to at least 197,072, SecurityWeek reported. Malwarebytes found a figure of 1,515,073 in the data behind the Texas listing, but it is not shown on the public page and Revolve has not confirmed it. Revolve is not offering free credit or identity monitoring, and class-action investigators such as Claim Depot started collecting affected customers in early November.
Still logged in? Lock the account down now
If you can still get in, you're racing the attacker. In this order: change the password to a long, unique one; sign out all other sessions/devices (the setting exists in Revolve's security settings); confirm the recovery email and phone number are yours (attackers quietly add their own so they can "recover" the account later); remove unfamiliar linked apps or API access; and turn on two-factor authentication. Only then deal with anything the attacker posted, sent or bought.
Got a "new login" alert from Revolve?
Treat it as real but verify it the safe way: never tap the link in the message itself (fake login alerts are a top phishing template for Revolve). Open the app or type the address yourself, check the active-sessions list in security settings, and if you see a device or location you don't recognize, sign it out and change your password immediately. If the alert was genuine, that password is burned — assume it's circulating and change it everywhere else you reused it.
The attacker spent, moved or stole orders, gift-card balance or loyalty rewards
Document everything first (screenshots of orders, trades or transfers, with dates), then report it through Revolve's official support flow — platforms restore fraudulent purchases and stolen orders, gift-card balance or loyalty rewards case-by-case, and a clean, dated report is what gets approved. If a card or bank account was charged, dispute the charges with the issuer as unauthorized. Change the password on the email account attached to Revolve too — if the attacker owns your inbox, they'll just take the account back.
Why this happened — and how to make sure it can’t again
About a third of account takeovers are credential stuffing: a password you used on Revolve (or the email behind it) leaked in some other company’s breach, and attackers replayed it here automatically. The FBI’s IC3 logged over 5,100 account-takeover complaints with $262M in losses in 2025 alone (IC3). Even when Revolve itself was never breached, your reused password from another site opens it.
So after recovery, check what’s already out there: our free scanner shows which known breaches and dark-web dumps include your email — and whether passwords were exposed with it.
Check my exposure — free →After you recover: three doors to close
- Unique password + 2FA. A password manager plus app-based two-factor stops both stuffing and phishing replays.
- Reset everywhere you reused that password — email first (it’s the master key), then bank, then the rest.
- Shrink your public footprint. Attackers research targets on data-broker sites (your address, phone, relatives — enough to social-engineer support lines). Our free opt-out guide covers 190 of them, step by step.
Hacked Revolve account, answered
How did my Revolve account get hacked?
The most common cause isn't a hack of Revolve itself — it's credential stuffing: a password you used on Revolve leaked from some other site's breach, and attackers tried it here automatically. Roughly a third of account takeovers happen this way, with phishing (fake Revolve login pages and alerts) close behind. That's why the first fix is a unique password, not just a new one.
Can I get my Revolve account back?
Usually yes. Use the official recovery flow (https://www.revolve.com/contactus) — it can verify you even when the attacker changed the email and password. Expect it to take a replacement card usually arrives within a week; disputed charges are typically settled by the issuer within one or two billing cycles; respond quickly to follow-ups so the case stays open.
Should I just make a new Revolve account instead?
Not until you've tried recovery. The old account keeps your history and contacts — and while the attacker controls it, it will be used to scam people who trust you. Recover it, or at minimum report it as compromised so Revolve can lock it, before you start over.
The hacker placed orders or drained gift cards on my Revolve account — now what?
Report the orders as unauthorized through Revolve's support, dispute any card charges with your bank, and check saved addresses and payment methods for ones the attacker added. Loyalty points and gift-card balances are a favorite target because people don't watch them like a bank account — screenshot balances and include them in the report.
How do I know if I was affected by the Revolve data breach?
Revolve says the breach touched customers who had a payment card saved in their account, and it began mailing notice letters at the end of October 2026. If you had a card saved and receive a letter, you are in the group. If you never saved a card, the stolen data would not include your card details, although your name and contact details may still be on file with the store.
Was my CVV stolen in the Revolve breach?
Revolve’s SEC filing lists names, contact information, card numbers and expiry dates, and does not mention the security code. That makes some online fraud harder but not impossible, because some merchants do not ask for the code. Replacing the card removes the risk entirely.
Is Revolve offering credit monitoring?
No. SecurityWeek reported that Revolve is not offering free credit or identity monitoring. For a stolen card, monitoring would not help much anyway: what protects you is a replacement card and close reading of your statements.
Is there a Revolve class action lawsuit?
In early November 2026 class-action investigators, including Claim Depot, began collecting affected Revolve customers. An investigation is not yet a settlement. If a settlement follows, the notice letter is the easiest proof that you were affected, so keep it.
How do I stop my Revolve account being hacked again?
Three things close most of the doors: a unique password (a manager makes this painless), app-based two-factor authentication, and shrinking your exposed footprint — checking your email against known breach databases and removing your personal data from data-broker sites that attackers use to research targets.