Pandora Confirms Third-Party Data Breach, Warns Customers About Phishing

Pandora, the world-famous Danish jewelry brand, has confirmed it was the target of a cyberattack that compromised customer data via a third-party platform. The company stresses that its internal systems were not breached.

What Happened

The incident, detected earlier this month, involved unauthorized access to customer names and email addresses. Pandora has confirmed that no passwords, credit card details, or other sensitive financial information were stolen.

The affected third-party platform has not been publicly named, but Pandora has acted swiftly to restrict further access and has contacted potentially impacted customers directly.

Potential Risks

While the stolen data may seem minimal, names and email addresses are highly valuable to cybercriminals for phishing campaigns. Attackers can use them to impersonate trusted companies, tricking recipients into revealing more sensitive information.

Pandora has stated:

“We have carried out extensive checks, and to date we cannot see any evidence that this data has been shared or published. However, as a precautionary measure, we recommend that you pay extra attention to unusual emails and online activities prompting you for your data.”

Industry Context

Security experts note that retail is facing increasing cyber risks. Data theft—especially through third parties—is becoming more common, with Q2 2025 showing a 58% increase in retail ransomware incidents compared to the previous quarter. Attackers often prefer silent data exfiltration over disruptive attacks, enabling prolonged exploitation of stolen information.

How to Protect Yourself

If you are a Pandora customer:

• Be cautious of unexpected emails claiming to be from Pandora.
• Avoid clicking on suspicious links or opening unknown attachments.
• Never share passwords or payment information via email.
• Consider enabling multi-factor authentication on all key accounts.

---

🔐 At Alcaeus, we help businesses strengthen their cybersecurity posture and prepare for threats like these. If your company relies on third-party platforms, now is the time to review your vendor security policies and incident response plans.

Contact us.