It seems they don't necessarily have to be using a cloud-based service to sell/leak phone numbers to a third party?