Three million phone numbers accessed in data breach in France
600,000 of the numbers were registered with Bloctel
Published
Three million telephone numbers have been accessed in a data breach involving Bloctel, France’s former opt-out service for consumers to register their phone numbers to opt out of unsolicited marketing calls.
The breach was confirmed by the Direction générale de la concurrence, de la consommation et de la répression des fraudes (DGCCRF), the French authority responsible for competition, consumer affairs and fraud control.
It took place just before Bloctel was permanently closed following France’s new rules on telephone marketing.
According to the DGCCRF, a cybercriminal gained fraudulent access to a professional account and retrieved files containing three million telephone numbers. Of these, 600,000 were registered with Bloctel.
A professional account is an account used by a business involved in telephone marketing to access Bloctel and check its prospecting phone-number lists against the Bloctel opt-out list.
However, the government said that the breach did not expose other personal information.
“Only telephone numbers were exposed, without any other personal data (name, address, etc.),” the DGCCRF said in its official statement.
It added that “the Bloctel database itself has not been compromised.”
Those registered with Bloctel whose numbers were affected have been notified.
The hacked account was blocked as soon as the incident was discovered, and all professional accounts checked.
What should affected consumers do?
The DGCCRF is advising consumers to be particularly cautious about unexpected calls and text messages following the breach.
It recommends not responding to unknown calls or messages, being cautious with any links and never providing personal information such as account details over the telephone.
Consumers should also consider changing passwords where their telephone number is used as an identifier for online services.
Finally, the authority also warned people to be alert to unusual requests, such as instructions to change a SIM card or update passwords.
The breach comes as Bloctel ends
The incident occurred just as France moved away from its previous opt-out system for telephone marketing.
Bloctel officially ended on August 11. Since then, businesses must now obtain a consumer’s explicit, prior consent before making commercial calls.
This means consumers no longer need to register with Bloctel to refuse marketing calls. Instead, an opt-in system is now in place where they need to give their explicit consent in order to be contacted.
There are some exceptions, including calls concerning an existing contract and certain newspaper, magazine and periodical subscriptions.
Consumers who receive an unsolicited commercial call can report it via SignalConso, ask the company to delete their data and keep evidence such as the caller's number, date and time of the call.
