Orange Spain is adding the user MSISDN in every HTTP request it sends. Due to this, any web site you visit now has your number.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/93301/orangespain-disclose.txt
Source: https://packetstormsecurity.com/files/93301/Orange-Spain-Phone-Number-Embed.html