[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCXnOn8aorXVV9gvgEXNoEqCXse-rLV3nfuSQF6EYz-M":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":132},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"7cade95d-8e92-44bf-a907-d96ea310a59d","Revolve Puts Data Breach Victim Count at 1.5 Million","revolve-puts-data-breach-victim-count-at-1-5-million-97dd5a","Online fashion retailer Revolve has told regulators that the September cyberattack affected more than 1.5 million individuals. The post Revolve Puts Data Breach Victim Count at 1.5 Million appeared first on SecurityWeek.","Online fashion retailer Revolve has disclosed that a cyberattack in September affected 1,515,073 individuals. The breach, which occurred on September 11, involved unauthorized access to systems including the e-commerce platform. The exposed data may include names, mailing addresses, and payment card information for customers who stored payment methods in their online accounts.","Revolve data breach impacts over 1.5 million individuals.","https:\u002F\u002Fwww.securityweek.com\u002Frevolve-puts-data-breach-victim-count-at-1-5-million\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F07\u002Fdata-breach-healthcare-medical.jpg","2026-11-09T14:08:08+00:00","2026-11-09T15:00:17.251371+00:00",7,[17],{"name":18,"type":19},"Revolve","vendor","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":20,"icon":22,"name":23,"slug":24},null,"Breaches","breaches",[26,28,33,38],{"category":27},{"id":20,"icon":22,"name":23,"slug":24},{"category":29},{"id":30,"icon":22,"name":31,"slug":32},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18],{"controls":46,"vendors":131},[47,76,102],{"slug":48,"name":49,"problem":50,"products":51},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":77,"name":78,"problem":79,"products":80},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":98,"product_name":99,"url":100,"description":101},"ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"slug":103,"name":104,"problem":105,"products":106},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[107,115,123],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-incident-response","Truesec Incident Response","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fincident-response","Incident response team with a retainer option.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",[],{"slug":133,"title":134,"body":135,"framework_refs":136,"framework_notes":144},"revolve-data-breach-exposes-15m-customers-payment-and-personal-data","Revolve Data Breach Exposes 1.5M Customers' Payment and Personal Data","Unauthorized access to Revolve's e-commerce platform in September 2024 exposed the personal and payment card data of over 1.5 million customers, highlighting the severe risks of storing sensitive payment information in online retail environments. The breach demonstrates that e-commerce platforms holding payment card data are high-value targets requiring robust access controls and data minimization practices. Storing full payment card details rather than tokenized references dramatically amplifies the impact of any unauthorized access event. This incident matters because it affects over a million consumers' financial security and exposes Revolve to significant regulatory and reputational consequences under payment card industry and data protection obligations.",[137,138,139,140,141,142,143],"PCI DSS Requirement 6","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 3: Data Protection","GDPR Article 32","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 17: Incident Response Management","NIS2 Article 21(2)(b)",{"GDPR Article 32":145,"NIS2 Article 21(2)(b)":146,"PCI DSS Requirement 6":147,"CIS Control 3: Data Protection":148,"CIS Control 17: Incident Response Management":149,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":150,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":151},"GDPR Article 32 requires organizations to implement appropriate technical measures, including encryption and data minimization, to protect personal data; storing payment and mailing details without adequate safeguards for 1.5 million individuals is a direct violation of this obligation.","NIS2 Article 21(2)(b) requires entities to implement measures for incident handling and access control over critical systems; compliance would have mandated the kind of access monitoring and response capability that could have detected and stopped this intrusion earlier.","PCI DSS Requirement 6 mandates that cardholder data environments are protected through secure development, patching, and vulnerability management — controls that, if fully applied, would have hardened the e-commerce platform against unauthorized access to payment card data.","CIS Control 3 calls for identifying, classifying, and protecting sensitive data — including through encryption and tokenization — which would have reduced the value of any data the attacker accessed in Revolve's systems.","A mature incident response plan — as required by CIS Control 17 — would have enabled Revolve to detect the breach faster, contain unauthorized access sooner, and reduce the total number of individuals whose data was exposed.","This control requires timely identification and remediation of technical vulnerabilities in information systems; applying it to the e-commerce platform could have closed the security gaps exploited during the September attack.","This control requires that access to systems holding sensitive data be strictly managed and authenticated; enforcing least-privilege and MFA on the e-commerce platform could have prevented or limited the unauthorized access that led to this breach."]