Pandora Confirms Customer Data Breach via Third-Party Platform, Warns of Potential Phishing Risk

Global jewellery retailer Pandora has confirmed a data breach involving customer information, urging affected users to stay vigilant for potential phishing attempts.

In emails sent to customers on Tuesday, the Danish brand revealed the breach stemmed from a third-party platform it uses, though it stopped short of naming the provider.

Pandora stressed that no passwords, payment card details, or sensitive financial data were compromised, stating that the breach was limited to “very common types of data” such as names and email addresses.

Attack Stopped, But Caution Urged

Details

The cyberattack has been contained, with Pandora saying it has since “strengthened security measures”. However, cybersecurity experts warn the data could still be abused, even if it hasn’t surfaced on public leak sites yet.

Pandora suspects the breach could be tied to a third-party email provider, similar to high-profile breaches involving platforms like SendGrid or MailChimp.

Not Tied to Ransomware—For Now

Though Pandora said it found “no evidence” of the data being shared or published, ransomware and privacy experts, including Dr. Darren Williams, CEO of BlackFog, warn that stealth data exfiltration tactics are becoming the new norm.

“Rather than immediate disruption, attackers are quietly harvesting sensitive information to power extortion schemes, identity fraud, and dark web trade,” said Williams. “The damage often continues long after the initial compromise.”

A String of High-Profile Retail Breaches

Pandora is the latest in a growing list of UK retailers to fall victim to cyberattacks. Recent breaches at Marks & Spencer (M&S), Harrods, and Co-op have prompted concerns about the retail sector’s resilience to sophisticated attacks.

The M&S cyberattack in July cost the company around £300 million ($409 million) in operational losses. British police have since arrested four individuals linked to a hacking group believed responsible for attacks on M&S, Harrods, and Co-op.

Pandora’s Customer Advisory

In its email, Pandora urged customers to exercise caution:

“As a precautionary measure, we recommend paying extra attention to unusual emails or online activities that prompt for your personal data, as these could be phishing attempts pretending to be associated with Pandora.”

Customers were also advised not to click on links or download attachments from unknown sources.