Pandora Music Streaming Service Breach (Salesforce, 2025): 8.9 Million Subscriber Email & Home Address Records Exposed

About Pandora

Pandora is a music streaming and internet radio service operating in the United States, offering both free ad-supported and paid subscription tiers. The platform pioneered the Music Genome Project approach to personalized radio recommendations. Pandora was acquired by SiriusXM in 2019 and now operates as part of the SiriusXM Holdings portfolio alongside the satellite radio service. It competes with Spotify, Apple Music, and Amazon Music in the streaming market.

Why They Hold Your Data

Streaming services collect user accounts, emails, subscription data, listening history, device identifiers, and ad or recommendation signals across music-delivery platforms.

Recent Developments

Pandora has operated under SiriusXM's ownership with continued investment in its personalized radio and on-demand streaming products. SiriusXM has been managing subscriber and revenue dynamics across its combined satellite and streaming portfolio. No major standalone Pandora organizational developments beyond the breach have been prominently reported in the recent period.

Data Points Exposed

Breach Impact

Pandora was among the approximately 39 organizations listed on the Scattered LAPSUS$ Hunters dark web leak site in October 2025, with customer contact data including email addresses, phone numbers, and home addresses published as part of the Salesforce campaign. Pandora has not made detailed public statements about its specific response or the scope of its exposure in this campaign.

Exploitation & Downstream Threats

• SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure

What You Should Do

1. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
2. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
3. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).