If you’re a French citizen who registered your phone number with Bloctel to avoid unwanted marketing calls, you may want to be extra careful about unexpected calls and messages.

France's Directorate General for Competition Policy, Consumer Affairs and Fraud Control (DGCCRF) has warned that a cybercriminal obtained files containing 3 million phone numbers, including 600,000 registered with Bloctel.

Key takeaways

• 3 million phone numbers were exposed, including around 600,000 registered with Bloctel
• Names, addresses and other personal information were not exposed in this incident, according to French authorities
• Criminals could combine leaked phone numbers with information from previous data breaches or other sources to identify and target individuals
• Affected users should be wary of suspicious calls, texts, password-reset requests and unexpected SIM changes
• Bloctel officially closed on Aug. 11 as France moved to an opt-in system for commercial telephone calls

How can a leaked phone number still be useful to scammers?

A phone number on its own provides relatively little information. The problem is that criminals don't use information from just one breach.

Names, email addresses, passwords, dates of birth, addresses and other personal information have been exposed in countless previous data breaches.

If your phone number appears in one leaked dataset and your name or email address appears in another, criminals may connect the dots. They can also search social media, public records and other online sources for additional information.

And if they still don't know enough about you, they may simply try to get you to reveal it.

A scammer might call pretending to represent your bank, mobile provider or another trusted organization. Knowing your phone number or a few other details collected from elsewhere can make the story considerably more convincing.

What should affected Bloctel users watch out for?

The DGCCRF recommends being cautious about unknown calls and text messages, avoiding suspicious links and never disclosing personal information over the phone.

Consumers should also watch for unusual activity they didn't initiate, particularly SIM card changes and password updates. If your phone number is used as the login identifier for an online service, the DGCCRF recommends changing your password.

Unexpected authentication codes, password-reset messages and account recovery notifications should also get your attention.

If someone calls claiming to represent your bank, mobile operator or another company and asks for sensitive information, end the conversation and contact the organization yourself using an official phone number, website or app.

If your phone number has been exposed, a few additional tools can help you spot suspicious activity and scams.

Check your digital footprint. Bitdefender Digital Identity Protection can help you monitor your personal information and discover whether your data has been exposed. This can be particularly useful when a phone number may be linked to information leaked elsewhere.

Check suspicious messages before acting. If you receive an unexpected SMS, email, QR code or other suspicious communication, you can ask Bitdefender Scamio to analyze it and help determine whether you're dealing with a scam.

Check unfamiliar phone numbers. If you receive a call from a number you don't recognize, Bitdefender Reverse Phone Lookup lets you check the number for signs of spam or scam activity before you decide whether to call back or engage with the caller.

Reduce unwanted and suspicious calls. Bitdefender Mobile Security for Android includes Call Blocking, which can automatically block known scam and spam callers. Its AI-powered detection can also identify suspicious calling patterns, including unusual or potentially spoofed numbers, while users can create their own block lists for unwanted callers.

No tool can prevent every fraudulent call, particularly when criminals continually change or spoof phone numbers. Treat these protections as another layer of defense alongside healthy skepticism about unexpected callers.

Bloctel has officially closed

The incident arrived just before the end of Bloctel itself.

Bloctel officially closed on Aug. 11, 2026. France now operates under an opt-in system for commercial telephone calls. Instead of consumers having to register their refusal to receive marketing calls, businesses must generally obtain explicit, prior and traceable consent before calling and be able to prove that consent was given.

Consumers who receive commercial calls without providing consent can report them through SignalConso, request that the company delete their information, and preserve evidence such as the caller's number and the date and time of the call.