Egidio

The Threat Laboratory → Bloctel

🌐 Français

Case file · August 21, 2026

Bloctel: France's do-not-call registry breached right before it shut down

France's public do-not-call registry leaked in the days before its permanent closure on August 11, 2026. 600,000 of the exposed numbers belonged to people who had specifically registered to be protected. Confirmed by the state, detailed by the consumer-protection authority.

⚠️ What makes this case different. Bloctel wasn't a private company — it was France's public do-not-call registry. Its breach isn't just another incident: it's the very system meant to protect French residents from telemarketing that exposed the numbers of people who had specifically sought that protection, in the very days of its shutdown.

The numbers, confirmed by the state

3M
Phone numbers exposed in total, across two distinct files.
DGCCRF, statement of 08/12/2026.
600,000
Of these, numbers belonging to people registered on the Bloctel opt-out list itself.
DGCCRF, statement of 08/12/2026.
Aug 11
Date Bloctel permanently closed — and the same day the state first officially confirmed the breach.
Law of June 30, 2025; DGCCRF.
0
Names, addresses or other personal data exposed — only phone numbers leaked, according to the authorities.
DGCCRF, statement of 08/12/2026.

Timeline

CLAIMED
August 6, 2026
A claim appears on a cybercrime forum, under the pseudonyms "Cybernox" and "don't call me," announcing the free release of a file containing 3 million phone numbers, presented as complete. The mechanism alleged by the hackers — a professional account without two-factor authentication — is not confirmed by the DGCCRF.
CONFIRMED
August 11, 2026
Bloctel permanently closes, per the law of June 30, 2025 introducing a prior-consent (opt-in) regime for commercial telemarketing calls. The same day, the state confirms the breach: unauthorized access to a professional account allowed files containing phone numbers to be downloaded.
CONFIRMED
August 12, 2026
The DGCCRF publishes its statement: two distinct files were retrieved — the numbers initially submitted by a business, and those returned after checking against the Bloctel opt-out list. The compromised account was blocked, and all professional accounts were reviewed. Affected Bloctel registrants were notified by email.

⚖️The regime shift, in one sentence

Until August 11, France ran on opt-out: by default you could be called for telemarketing, unless you registered with Bloctel to refuse it. Since then, the regime is opt-in: commercial telemarketing calls are banned by default, unless you've explicitly consented in advance. This breach is the last incident of the system it replaces.

What it changes for you

A phone number alone can't empty a bank account. But cross-referenced with other breaches already documented on this site — often far richer in personal data — it lets an attacker reconstruct a profile and know who to call. That's exactly the mechanism described in From Leak to Scam: every leak, even one that looks minimal, feeds the next one.

There's also an irony worth stating plainly: the 600,000 people registered with Bloctel had taken that step specifically to stop being bothered. Their number ended up exposed by the very service meant to protect them. This isn't a criticism aimed at anyone in particular — it's a reminder that no system is invulnerable, including ones built for protection.

🔒 Since August 11, unsolicited commercial telemarketing is all the more suspicious for being the exception now, not the rule. A call that persists despite a refusal, or cites your number as proof of legitimacy, deserves the same suspicion as before. See how Medusa tells channels apart.

Frequently asked questions

Is the Bloctel breach confirmed?

Yes. The French state confirmed the incident on August 11, 2026, and the DGCCRF published its statement on August 12. Unauthorized access to a professional account allowed files containing phone numbers to be downloaded. The Bloctel database itself was not compromised.

What data exactly was leaked?

Only phone numbers — 3 million in total, of which 600,000 belonged to people registered on the Bloctel opt-out list. No names, addresses, or other personal data, according to the authorities.

Does Bloctel still exist?

No. The service permanently closed on August 11, 2026, replaced by an opt-in consent regime. Affected registrants were notified by email.

📌 Last checked: August 21, 2026. Verifiable information to report: contact@egidio.app.

Related reading

Free, Bouygues, SFR: the fiber-tool pattern From Leak to Scam Global Scam Report 2026 CareCloud: the US health breach
Cite this page Egidio — The Threat Laboratory, "Bloctel: France's do-not-call registry breached right before it shut down," egidio.app/en/laboratoire/bloctel-breach-shutdown/. Licensed CC BY 4.0.

Free to reuse, including commercially, with attribution. Reuse terms.