Revolve Says 1,515,073 People Were Affected by Data Breach
Affected shoppers are those who had saved a payment method to their accounts, and the company has not yet explained how the intruder got in.
Online fashion retailer Revolve has told the Indiana Attorney General that 1,515,073 people were affected by a data breach it first disclosed in October, a figure it had not previously published. Revolve filed the incident with the SEC on October 29 and began mailing notices to customers around that time. Its state notices in Iowa, Massachusetts, South Carolina, Texas and Vermont together covered about 197,000 people. The intrusion, which Revolve says began on September 11 and came to its attention on September 29, reached parts of its systems including its e-commerce platform, and the intruder may have used automated tools to pull names, contact details and stored card numbers with expiration dates. Only customers who had saved a payment method to their accounts were exposed, and the company has referred the matter to federal law enforcement and brought in outside cybersecurity specialists, but it has not explained how access was gained and no hacking group has claimed responsibility.
Why it matters
The updated count is far larger than the roughly 197,000 people covered in the notices filed with regulators in five states, so many more customers may have had their names, contact details, card numbers and expiration dates exposed than the earlier filings suggested. Shoppers who stored a card on Revolve should assume their data was among those taken and watch for unusual activity on that card. The unexplained entry point means the scope of the intrusion is still not fully clear.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.