Many smartphone apps, websites, and cloud services request access to your contact list when you sign up. If you grant access to a malicious app, or a legitimate app gets hacked or breached, spoofers can access all of the numbers in your contact list. A company that has access to your contact list was hacked.