Revolve

Summary

Revolve notified at least 180,000 individuals that their personal and payment card information was stolen after unauthorized access to its systems, including the e-commerce platform. The company initiated incident response and contained the activity, with its investigation indicating that names, addresses, payment card numbers, and expiration dates may have been exfiltrated from customer accounts where data was saved. Notification letters were sent to at least 179,259 people based on filings with state attorneys general, while law enforcement was notified and a cybersecurity firm was retained to assist with remediation. The retailer stated there was no operational disruption or service interruption and that the incident is not expected to materially affect its business, though affected individuals are not being offered free identity theft or credit monitoring services.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Online fashion retailer Revolve experienced a data breach that occurred on September 11 and involved unauthorized access to certain company systems, including the company’s online shopping platform. The company’s investigation into the incident determined that the hackers may have accessed and exfiltrated the names, addresses, payment card numbers, and payment card expiration dates of customers who saved the data to their accounts on the company’s e-commerce platform. Revolve is notifying at least 180,000 individuals that their personal and payment card information was stolen in the data breach. The retailer has not shared the number of impacted individuals or details on who hacked it and how. SecurityWeek has emailed the company for additional information on the data breach and will update the article if it responds.

Immediately after learning of the cyberattack, Revolve initiated incident response and contained and remediated the unauthorized activity. The company notified law enforcement and retained a cybersecurity company to help with the remediation efforts. Last week, the company started notifying the potentially affected individuals of the data breach. Based on notices filed with the Attorney General’s offices in Iowa, Massachusetts, Texas, and Vermont, Revolve sent notification letters to at least 179,259 people. The fashion retailer said this incident has not resulted in operational disruption or interrupted service to any customers. As of the date of the report, the company does not believe this incident will have a material impact on its business.

The company is not providing the affected individuals with free identity theft or credit monitoring services. Instead, Revolve reminds them to review their account statements and remain vigilant for incidents of fraud or identity theft. No additional information regarding the attack methodology, threat actor attribution, or revised impact figures has been made public by the retailer at this time.

Sources

Sources available to members: 1 source.