Online fashion retailer Revolve has informed the Indiana Attorney General’s Office that 1,515,073 individuals were impacted by the data breach it disclosed in October.
The company revealed the incident on October 29 in a filing with the US Securities and Exchange Commission (SEC). It started sending notification letters to impacted customers around the same time.
Revolve had not publicly shared a total. Its notices to regulators in Iowa, Massachusetts, South Carolina, Texas, and Vermont covered roughly 197,000 people combined.
The retailer says an unauthorized party broke into some of its systems, including its e-commerce platform, on September 11. Per the Indiana Attorney General’s records, Revolve became aware of the intrusion on September 29.
According to the company, the intruder may have relied on “automated means” to collect customers’ names and contact information, including mailing addresses, along with their card numbers and expiration dates.
The exposure is limited to shoppers who chose to store a payment method in their online accounts.
Revolve reported the attack to federal law enforcement and enlisted external cybersecurity experts to help with its response.
The company has yet to explain how the hackers got into its systems. So far, the attack has not been publicly claimed by any hacker group.
Related: Iris Plaza Breach May Have Exposed Data of 7.7 Million Customers
Related: Amplifon Americas Data Breach Impacts 1.3 Million
Related: Over 3 Million People Hit by Frontline Education Data Breach
