France's DGCCRF, the national competition, consumer affairs and fraud-control authority, confirmed on Wednesday 12 August 2026 that a cybercriminal fraudulently accessed a Bloctel professional account and retrieved files containing three million telephone numbers, 600,000 of which belonged to consumers registered on the Bloctel do-not-call list. The regulator states that only phone numbers were exposed, with no names, addresses or other personal data, and that the Bloctel database itself was not compromised. The incident occurred shortly before Bloctel was permanently shut down on 11 August 2026 under France's new opt-in telemarketing law. Affected registrants have been notified by email and France's data protection authority, the CNIL, has been informed.
What Happened
The sequence is unusually tight. According to Les Numériques, rumours of a Bloctel leak began circulating on 6 August; the service was switched off on 11 August as scheduled; an email to affected users went out the same day; and the DGCCRF issued its official statement on 12 August. BFMTV and Anadolu Agency both credit the specialist site French Breaches with surfacing the incident first, after data linked to the platform was published and offered on a cybercriminal forum. Les Numériques adds that, per French Breaches, the data was distributed free of charge on that forum rather than sold, so accounts differ on whether the dataset was sold, given away, or both.
Attribution is the significant gap here. No source names a threat actor, group, or motive. There is no ransomware claim, no extortion note, and no indication of persistence beyond the single compromised account. What exists is a regulator statement describing account misuse and a leak-tracking site describing forum distribution.
One material framing discrepancy runs through the coverage. BFMTV's headline and lede describe the leak as affecting "jusqu'à 3 millions d'utilisateurs inscrits" (up to 3 million registered users), and Anadolu Agency's English write-up follows that framing with "up to 3 million users' phone numbers." The DGCCRF's own wording, carried verbatim by AFP through Le Figaro and TF1 Info, is narrower and should be weighted higher: three million numbers in the stolen files, of which 600,000 were Bloctel registrants. The remainder were prospecting numbers held by the business, not opt-out list members. Readers relying on the BFMTV or Anadolu framing will overstate registrant exposure by a factor of five.
A minor factual conflict also exists on Bloctel's own history: Frandroid dates its launch to 2016, while L'Usine Digitale writes that the service died "twelve years after its creation," implying 2014. Neither is load-bearing for the incident.
What Was Taken
Files of telephone numbers, and by every account nothing more.
- Volume: three million phone numbers total, consistently reported across all eight sources with no competing figure at the top line.
- Registrant subset: 600,000 numbers belonging to individuals actually enrolled on the Bloctel opt-out list, per the DGCCRF and repeated by Connexion France, L'Usine Digitale, TF1 Info and Frandroid.
- Format: numbers appeared in clear text within search results and exchanged files, according to BFMTV, Anadolu and Frandroid, all sourcing that detail back to French Breaches.
- Not taken: names, postal addresses or other identifying fields. The DGCCRF is explicit: "Only telephone numbers were exposed, without any other personal data (name, address, etc.)."
- Not touched: the Bloctel opt-out database itself. The regulator has stated this twice, and Le Figaro, TF1 Info and L'Usine Digitale all carry it.
The absence of names genuinely does constrain the damage. As L'Usine Digitale notes, the more sophisticated scenarios such as identity theft are largely off the table without nominative data. What remains is a clean, high-quality list of live French mobile and landline numbers, a fraction of which are demonstrably owned by people who care enough about unsolicited contact to have registered against it.
Why It Matters
The irony is doing a lot of work in the French coverage, and it is more than a joke. A do-not-call registry is, structurally, a curated list of confirmed-live numbers attached to consumers who self-identified as targets of telemarketing. Leaking it hands scammers a pre-qualified calling list assembled by the state. Frandroid's framing is blunt: the public service meant to protect people from cold-calling let its registrants' numbers escape.
Three broader lessons sit under this incident.
First, the perimeter was not the victim's core database. It was a third-party business account with legitimate query access, which is exactly the design of the service. Bloctel worked by letting telemarketing firms upload prospecting lists and check them against the opt-out register. That partner-facing surface, not the crown-jewel datastore, is where the loss occurred. Organisations that measure their exposure by counting their own databases will systematically miss this class of risk.
Second, the timing. This happened in the final days of a twelve-year-old public service being decommissioned. Systems in sunset mode routinely lose their security owner before they lose their data, and a platform three days from shutdown is a platform whose access reviews, MFA rollouts and monitoring have already been deprioritised. Decommissioning is a security event, not an administrative one.
Third, "only phone numbers" is a real mitigation but not a clean bill of health. The DGCCRF itself warns consumers to stay alert to unusual solicitations and to requests for action they did not initiate. Bloctel's own notification email, obtained by BFM Tech, states that disclosure of a phone number "can, in particular, facilitate the receipt of unwanted calls or SMS messages, as well as attempts at fraud or phishing." The predictable follow-on is a smishing wave against these three million numbers, plausibly themed around Bloctel's shutdown or the new opt-in regime, which gives attackers a legitimate, well-publicised pretext to work with.
The Attack Technique
The root cause reported is straightforward credential misuse against an under-protected partner account, and it is worth being precise about which tier is claiming what.
The DGCCRF confirms only that a cybercriminal gained fraudulent access to a professional account and used it to retrieve files. The regulator does not, in the statements quoted by AFP, specify how the credentials were obtained.
The missing-MFA detail comes from French Breaches via BFMTV, Anadolu and Frandroid, and should be treated as reported rather than officially confirmed. BFMTV attributes it to "l'administration," writing that the absence of two-factor authentication on a business-facing account allowed numbers to be retrieved freely, displayed in clear text in search results. Les Numériques is more careful, noting the official communication gave no figures at all and describing the account as "very probably not sufficiently protected." Anadolu reports it as French authorities saying hackers exploited a business account lacking two-factor authentication.
So: single-factor or otherwise compromised credentials on a legitimate integration account, abused to bulk-export data the account was authorised to see in small volumes. No exploit, no malware, no lateral movement described by anyone.
Containment, per the DGCCRF and echoed by TF1 Info and L'Usine Digitale, was blocking the compromised account as soon as the incident was detected, then running verification across the full set of professional accounts. BFMTV reports the professional accounts used by the attackers were deactivated, phrased in the plural, which sits slightly oddly against the regulator's singular "a professional account." The sources do not resolve whether more than one account was ultimately implicated.
What Organizations Should Do
- Enforce MFA on partner and machine-adjacent accounts, not just employee ones. The account class that failed here was a B2B integration login. Inventory every external account with query access to your data, and treat any without a second factor as an open export channel.
- Rate-limit and alert on bulk retrieval by legitimate accounts. A telemarketing firm checking lists against an opt-out register has a normal query profile. Pulling files totalling three million records is not it. Volumetric anomaly detection on authorised sessions is the control that would have caught this, and access control alone never will.
- Stop returning identifiers in clear text at scale. The opt-out use case only requires a match or no-match answer. Hashed or tokenised comparison, or returning suppression verdicts instead of raw numbers, would have made the exfiltrated files far less valuable. Design partner APIs to answer the question, not to hand over the dataset.
- Put decommissioning under formal security governance. Assign an accountable owner through the final shutdown date, keep logging and alerting live until the lights are actually off, and revoke third-party credentials before the platform goes dark rather than after.
- Pre-brief support and fraud teams for the smishing follow-on. Both the DGCCRF and Bloctel's notification flag unwanted calls, SMS and phishing as the concrete risks. Expect lures impersonating Bloctel, the DGCCRF or the new opt-in scheme. The standing advice given to consumers holds for staff too: do not click links in unsolicited SMS, never give personal or banking details to an unverified caller, and hang up and verify independently.
- Communicate scope precisely, then repeat it. The DGCCRF moved fast specifically to prevent confusion, and it still lost control of the 3M-versus-600K distinction in a chunk of the coverage within twenty-four hours. If your breach notification contains a nested figure, lead with the plain-language version of who is actually affected.
Sources: France Bloctel data breach: three million phone numbers accessed | Jusqu'à 3 millions de numéros concernés: fermée le 11 août, la plat... | Bloctel victime d’une fuite de données juste avant sa fermeture, 3... | Fuite de données chez Bloctel : 3 millions de numéros ... | Trois millions de numéros de téléphone sont concernés : la liste Bl... | Data breach exposes up to 3M phone numbers in France | Bloctel piraté : la DGCCRF confirme le vol de 3 millions de numéros... | Pour accompagner sa fermeture, Bloctel confirme le vol de nombreux...