Revolve Group, Inc. Data Breach Notice (Oregon Attorney General)

The filing from Revolve Group, Inc. confirms that personal information belonging to some of its customers was exposed in an incident on September 11, 2026. The company reported the event to the Oregon Department of Justice on October 29, 2026 — 48 days later. The record does not state how many people were affected.

Personal information cannot be replaced

When personal information leaves a company’s systems, the exposure is permanent. Unlike a credit card or password, these details cannot be cancelled or reset. If you were among those notified, the records tied to your name are now outside Revolve’s control and could be used in attempts at identity theft or fraud for years to come.

The filing lists only personal information as exposed. No passwords, no financial account numbers, and no government identifiers such as Social Security numbers appear in the disclosed categories. This is genuinely good news: the most dangerous permanent identifiers that usually drive long-term fraud risk are not part of this incident.

What the 48-day gap means

The breach occurred on September 11 and the notification was filed on October 29. State rules give companies time to investigate and prepare notifications, so the interval does not itself prove delay or negligence. Still, the gap is the most concrete timing fact the record provides. Customers learned about the exposure more than a month and a half after it happened.