Break HMAC-SHA256 of PAN with known hash?
Only for a trivial key.
You have HMAC(&lt;key&gt;, &lt;secret₁&gt;) = &lt;hash&gt;. The attacker knows &lt;hash&gt; and certain &lt;secret&gt;. Having a small search space, different &lt;secret&gt; values might be bruteforced.
However, with a proper (long, random) &lt;key&gt; the attacker won't be able to recover the other values. The HMAC-SHA256 itself is not reversible, and a long random &lt;key&gt; won't let them bruteforce them during their lifetime.
The real risk would be that during the data breach, in addition to the hashed values, the attacker also stole the &lt;key&gt;.