Danish jewellery large Pandora has disclosed a knowledge breach after its buyer data was stolen within the ongoing Salesforce knowledge theft assaults.
Pandora is among the largest jewelry manufacturers on the planet, with 2,700 places and over 37,000 staff.
“We’re writing to tell you that your contact data was accessed by an unauthorized social gathering by a third-party platform we use,” reads a Pandora knowledge breach notification despatched to prospects.
“We stopped the entry and have additional strengthened our safety measures.”
As first reported by Forbes, solely prospects’ names, birthdates, and e-mail addresses have been stolen within the assault. Passwords, IDs, and monetary data weren’t uncovered.
Pandora knowledge breach notification
Supply: Reddit
Whereas Pandora has not shared the identify of the third-party platform, BleepingComputer has discovered that the info was stolen from the corporate’s Salesforce database.
Since at the least January 2025, if not earlier, menace actors have been conducting social engineering and phishing campaigns focusing on corporations’ staff and assist desks.
These assaults are designed to steal Salesforce credentials or trick staff into authorizing a malicious OAuth utility to their Salesforce account.
Utilizing this entry, the menace actors obtain and steal the corporate’s Salesforce database, which is then used to extort the corporate into paying a ransom to forestall the info from being leaked.
ShinyHunters confirmed to BleepingComputer that they’re privately extorting corporations and can carry out a mass sale or leak of corporations that don’t pay a ransom sooner or later, like they did within the Snowflake data-theft assaults.
The menace actor additionally confirmed that the assaults are ongoing, so all corporations ought to assessment Salesforce’s suggestions on hardening their accounts.
“Salesforce has not been compromised, and the problems described should not because of any recognized vulnerability in our platform. Whereas Salesforce builds enterprise-grade safety into every little thing we do, prospects additionally play a important position in maintaining their knowledge secure — particularly amid an increase in subtle phishing and social engineering assaults,” Salesforce instructed BleepingComputer.
“We proceed to encourage all prospects to observe safety greatest practices, together with enabling multi-factor authentication (MFA), imposing the precept of least privilege, and punctiliously managing related purposes. For extra data, please go to: https://www.salesforce.com/weblog/protect-against-social-engineering/.”
Different corporations impacted in these assaults embody Adidas, Qantas, Allianz Life, and the LVMH subsidiaries Louis Vuitton, Dior, and Tiffany & Co.
Nonetheless, BleepingComputer has been instructed that there are various extra that stay undisclosed.
Malware focusing on password shops surged 3X as attackers executed stealthy Good Heist eventualities, infiltrating and exploiting important programs.
Uncover the highest 10 MITRE ATT&CK methods behind 93% of assaults and easy methods to defend towards them.
