Online fashion retailer Revolve has notified the Indiana Attorney General’s Office that 1,515,073 people were affected by the data breach revealed in October.
The company disclosed the incident on October 29 in a filing with the United States Securities and Exchange Commission (SEC). It began sending notification letters to affected customers around the same time.
Revolve had not publicly shared the total. Its notices to regulators in Iowa, Massachusetts, South Carolina, Texas and Vermont covered about 197,000 people in total.
The retailer claims an unauthorized person broke into some of its systems, including its e-commerce platform, on September 11. According to Indiana Attorney General records, Revolve became aware of the intrusion on September 29.
According to the company, the intruder may have used “automated means” to collect customers’ names and contact information, including their mailing addresses, as well as their card numbers and expiration dates.
Exposure is limited to buyers who have chosen to store a payment method in their online accounts.
Revolve reported the attack to federal law enforcement and brought in external cybersecurity experts to assist in its response.
The company has not yet explained how the hackers got into its systems. So far, the attack has not been publicly claimed by any hacker group.
Related: Iris Plaza breach may have exposed data of 7.7 million customers
Related: Amplifon Americas data breach affects 1.3 million people
Related: More than 3 million people affected by frontline education data breach
