Pandora jewelry network suffers data breach, hackers gain access to customer personal information

Jewelry Giant Pandora Confirms Data Breach After Cyberattack

Pandora, the globally recognized Danish jewelry powerhouse, has officially acknowledged a significant data breach following a sophisticated cyberattack. The incident, which impacted a third-party platform utilized by the company, resulted in unauthorized access to some customer information. While the full scope of the breach and its reach into the Ukrainian market remain unclear, Pandora is working diligently to assess the damage and reinforce its digital defenses.

Customer Data Accessed, But Sensitive Information Secured

In communication to affected customers, Pandora stated that the cyberattack, though concerning, was swiftly contained. The company assured patrons that the compromised data consists solely of commonly held information, such as names and email addresses. Crucially, Pandora emphasized that highly sensitive details like passwords, credit card numbers, and other confidential financial information were not accessed. This careful distinction is vital for customer peace of mind, even amidst the distress of a data compromise.

Investigation Underway; Vigilance Advised for Customers

Pandora has launched an internal investigation into the incident, with preliminary findings suggesting that the pilfered data has not yet been misused. Nevertheless, the company is urging its customers to remain vigilant. This includes closely monitoring for any unsolicited emails or online interactions that request personal details. The advice is straightforward yet essential: avoid clicking on links or downloading attachments from unknown or suspicious sources. This proactive stance from Pandora aims to mitigate any potential fallout from the breach.

ShinyHunters Suspected; Salesforce Denies Platform Vulnerability

While Pandora has not officially named the perpetrators, BleepingComputer reports suggest that the notorious hacking group ShinyHunters is the likely culprit. This group has a history of exploiting vulnerabilities in Salesforce's customer relationship management (CRM) platform. Since January 2025, ShinyHunters has employed various social engineering and phishing tactics to infiltrate corporate databases. In this instance, it appears their efforts successfully targeted Pandora's Salesforce instance, potentially leading to data extortion or sale on the dark web. However, Salesforce itself has vehemently denied any compromise of its platform, stating that the issues are not linked to any known vulnerabilities within their system. They stressed that while Salesforce provides robust security, client diligence in safeguarding their own data is paramount, especially in the face of evolving cyber threats.