According to Pandora, only customer names and email addresses, rather than passwords or credit card details, were copied by the attacker.