Revolve Group, Inc.

8-K Item 8.01 (not 1.05) dated 2026-10-29, filed 2026-10-30: 'recently became aware of unauthorized access to certain of its systems', 'confirmed the unauthorized activity was remediated', notified federal law enforcement and 'engaged leading external cybersecurity experts'. Actor obtained via automated means names, contact info, card number and expiry for customers with saved cards. Company says no operational disruption, not expected to be material. Only in-window 8-K with a new US cyber incident found by EDGAR full-text search.

Event: Sep 11

First public: Oct 29

Third-party report: Oct 29

Acknowledged: Oct 29

Other explanations considered: None for the incident itself; it is a data-theft (card) event without operational disruption, so not a critical-infrastructure operational signal.

1. Sep 11 · DIS
   Same-day multi-state AG notices: CA AG (breach 09/11/2026, reported 10/29/2026), Vermont AG 10-29-2026 (1,328 VT residents), Indiana AG notice 10/29/2026 (10,534 IN residents; 1,515,073 total). Texas count of more than 127,000 reported by The Record via...
   Source
2. Sep 11 00:00 UTC · DIS
   8-K Item 8.01 (not 1.05) dated 2026-10-29, filed 2026-10-30: 'recently became aware of unauthorized access to certain of its systems', 'confirmed the unauthorized activity was remediated', notified federal law enforcement and 'engaged leading external...
   Source