Revolve, the US online fashion retailer, told investors that attackers gained access to customers' credit card details. According to The Record, the attackers used "automated means" to obtain names, contact details, card numbers and expiration dates of customers who saved payment details in their accounts.
What is known
The company notified federal law enforcement and hired a cybersecurity firm to lead the response. According to Revolve, operations were not disrupted and it does not expect a material financial impact. Breach notifications were also filed in US states, including Vermont and Massachusetts. The total number of victims has not been officially confirmed.
"Automated means"
The wording suggests a credential stuffing attack: attackers take usernames and passwords leaked from other sites and try them automatically. Anyone who uses the same password on several sites is exposed, and if they saved a card in the account, the attackers get it too.
What to do
Anyone who shopped at Revolve and saved a card should watch for unusual charges and consider requesting a new card. In general: don't save card details on sites unnecessarily, use a different password for every site and enable two-factor authentication. Virtual cards, now offered by most Israeli card companies, add a layer of protection for online shopping.
