Revolve customers notified that their names, contact details and payment card or financial account numbers were involved in the retailer’s September 2026 data breach may be covered by a proposed class action alleging Revolve Group failed to protect that information. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes a class action complaint. The statements below are unproven allegations. Revolve Group has not been found liable, there is no certified class, and nothing to claim at this time. This page is informational and is not legal advice.
What Is This About?
A proposed class action filed November 4, 2026 alleges that Revolve Group, Inc., the Cerritos, California fashion retailer behind revolve.com, failed to protect customer data exposed in a September 2026 cyberattack. The case, Baltazar v. Revolve Group, Inc., No. 2:26-cv-12924, is in the U.S. District Court for the Central District of California.According to the complaint, unauthorized individuals gained access to Revolve’s systems on or about September 11, 2026, and Revolve discovered the intrusion on September 29, 2026. Revolve reported the breach to the Texas Attorney General on October 29, 2026 and began notifying customers on or about October 30 by mail and through a page on its website. The complaint puts the number of affected people at 1,515,073, including 127,200 Texans. Revolve has not yet responded in court.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Information Was Exposed?
The complaint says the data accessed included customers’ names, contact and address information, and financial information such as credit card numbers, debit card numbers and financial account numbers. It also says Revolve acknowledged that an unauthorized actor may have obtained, through automated means, customers’ names, contact information, payment card numbers and card expiration dates associated with payment information saved on its e-commerce platform.The complaint does not say how the attacker got in, and it says the notice did not describe any credit monitoring or other services offered to affected customers.
What Does the Lawsuit Allege?
The plaintiff, an Arizona resident who had a customer account on revolve.com, alleges that Revolve did not use reasonable security for the sensitive payment data it kept, failed to detect the intrusion for about 18 days, and waited roughly a month after discovering it to notify customers. The complaint argues that exposed card and account numbers can be misused immediately and repeatedly, and that customers now have to spend time monitoring their accounts and credit.It brings four claims on behalf of a nationwide class: negligence, negligence per se based on Section 5 of the Federal Trade Commission Act, breach of implied contract and unjust enrichment. These are allegations; the court has not decided whether any of them are true.
Who Could Be Covered?
The proposed class is all persons whose private information was compromised in the data breach Revolve disclosed on October 30, 2026, which the complaint estimates at about 1,515,073 people. A court has not certified the class.What Is the Plaintiff Asking For?
The lawsuit seeks damages and restitution, disgorgement of money Revolve allegedly gained from inadequate security, and court orders requiring Revolve to strengthen its data security, submit to independent audits and provide credit monitoring to affected customers, along with attorneys’ fees and a jury trial. The case was filed by Hadsell Stormer Renick & Dai LLP and Lowey Dannenberg, P.C.What Happens Next?
Revolve will have a chance to respond to the complaint, which could include a motion to dismiss. In large breaches, more suits often follow and are later consolidated before one judge. If the case settles or the plaintiff wins after class certification, class members would generally be identified from Revolve’s records and sent notice, and OpenClassActions.com will cover it.Questions
What information was exposed in the Revolve data breach?
According to the complaint, the exposed data included customers' names, contact and address information, and financial information such as credit card numbers, debit card numbers and financial account numbers. The complaint also says Revolve acknowledged that an unauthorized actor may have used automated means to obtain names, contact information, payment card numbers and expiration dates tied to payment information saved on its website.
How many people were affected by the Revolve data breach?
The complaint says 1,515,073 people were affected, including 127,200 Texans, based on the report Revolve filed with the Texas Attorney General on October 29, 2026.
Who would be in the Revolve class action?
The complaint proposes a single nationwide class of all persons whose private information was compromised in the data breach Revolve disclosed on October 30, 2026. A court has not certified the class.
Is there a Revolve data breach settlement?
No. The lawsuit was filed on November 4, 2026. There is no settlement, settlement fund or claim form, and Revolve has not yet responded in court.
Sources
• Docket, Baltazar v. Revolve Group, Inc., No. 2:26-cv-12924 (C.D. Cal., filed November 4, 2026), via CourtListener• Data Security Breach Reports, Texas Attorney General
