Pandora Confirms Cyberattack After Customer Data Breached via Third-Party Platform

Jewelry giant Pandora has confirmed it was the target of a cyberattack that resulted in the unauthorized access of customer data.

According to email notifications sent to affected users, the incident stemmed from a breach involving a third-party platform used by the company. The breach was first publicly acknowledged on August 5, when customers received emails titled, “This is an important service email from Pandora regarding a personal data breach.”

In the message, Pandora stated that the attacker had copied “only very common types of data” — specifically, customer names and email addresses. The company emphasized that no sensitive information such as passwords or credit card details had been compromised.

At this time, there is no indication that the stolen data has been published or leaked online. “Extensive checks” have been carried out, according to Pandora, and no evidence has been found that the information has been shared on dark web forums or other platforms.

The company did not confirm whether the attack involved ransomware, though recent incidents across the retail sector suggest it remains a possibility. Customers are advised to be cautious of suspicious emails or messages, particularly those impersonating Pandora, as these could be phishing attempts.

A Pandora spokesperson told Cyberinsider: “Protecting our customers’ privacy is of the utmost importance to us… We are working closely with our supplier to investigate the incident thoroughly and to implement all necessary measures to ensure this does not happen again. Based on the current stage of the investigation, we are confident that the attack has been contained.”

Although Pandora hasn’t disclosed the vendor involved or named the threat actor behind the breach, the incident follows a wider surge in cyberattacks exploiting third-party service providers such as Salesforce used by major global companies. Over the past month, organizations across different sectors — including Allianz Life, Adidas, Qantas, and certain LVMH brands — have reported similar breaches involving unauthorized access through cloud-based platforms. These campaigns often rely on deceptive methods like impersonation calls and account takeover techniques, raising concerns about coordinated targeting of enterprise customer relationship management systems.

This breach serves as a reminder that even limited data exposure can open the door to broader privacy and security risks. Attackers frequently bypass traditional security controls by manipulating people rather than systems. Businesses should invest in training employees to recognize social engineering threats, apply stricter oversight on third-party integrations, and audit cloud platforms for unusual activity. As attackers continue shifting tactics, proactive monitoring and stronger governance around data access remain critical.

UPDATE: Pandora has issued a statement to CyberInsider, and the article has been updated to reflect the latest information.