Revolve, an online fashion retailer, disclosed that a breach on September 11 exposed personal and payment card data of at least 200,000 individuals. Hackers accessed the company’s online shopping platform and may have exfiltrated names, addresses, payment card numbers and expiration dates of customers who saved the information to their accounts. Revolve said the incident did not disrupt operations or services and does not expect a material impact on its business. The retailer has notified law enforcement, retained a cybersecurity firm for remediation, and filed notices with the Attorney General’s offices in Iowa, Massachusetts, South Carolina, Texas and Vermont, sending letters to at least 197,072 people. Revolve is not offering free identity-theft or credit-monitoring services but advises affected users to review statements and stay vigilant for fraud. 1