Revolve Group Data Breach Notice (Washington Attorney General)

The names and financial & banking information of 24,859 customers of Revolve Group are now in the hands of unknown parties following a breach that occurred on September 11, 2026. The company filed notice of the incident with the Washington State Attorney General on October 29, 2026 — 48 days later.

This combination of data does not decay. While passwords were not exposed and no permanent identifiers such as Social Security numbers appear in the filing, a name paired with banking details can be used for targeted fraud, account takeover attempts, and long-term identity theft schemes that persist for years.

Name and Banking Details Create Persistent Fraud Risk

The filing lists name and financial & banking information as exposed in the incident. These two categories together allow criminals to craft convincing phishing messages, attempt unauthorized transfers, or open new accounts that look legitimate because they already contain verified personal and financial context.

Unlike a credit card number that can be replaced, the linkage between your name and banking records cannot be undone. That linkage remains valuable to fraudsters long after the initial breach is forgotten.