Paris: A data breach involving France's former anti-telemarketing platform Bloctel may have exposed up to 3 million users' phone numbers, local media reported Wednesday. The breach was disclosed shortly after Bloctel ceased operations on August 11 under new legislation regulating commercial calls and text messages, according to broadcaster BFMTV.

According to Anadolu Agency, cybersecurity website French Breaches first reported the incident after data linked to the platform was published and offered for sale on a cybercriminal forum. French authorities stated that hackers exploited a business account that lacked two-factor authentication, allowing them to retrieve users' phone numbers, which appeared in plain text during searches.

Bloctel confirmed that only phone numbers were exposed and the leaked data were not linked to users' names or other personal information. Not all registered users were affected, Bloctel said, adding that those concerned had been notified by email.

"Disclosing a phone number can, in particular, facilitate the receipt of unwanted calls or SMS messages, as well as attempts at fraud or phishing," Bloctel warned. The compromised business accounts were deactivated, while France's data protection authority, the CNIL, was notified of the breach, according to Bloctel.

Bloctel had allowed consumers to register their numbers on a do-not-call list. Under the new law, companies must instead obtain consumers' 'free and informed' consent before using their numbers for commercial calls or text messages.