Seems like an attacker could run hashes for  all numbers + common names and look for matches. Then it’s just a question of compute and how far down the list of “common” names they want to go. 

 yeah might need first + last, even then it could still be brute forced eventually… so single users could be cracked if someone was motivated enough 

 The only other thing I could think of is doing a hash of a range of numbers 🤔 so cracking doesn’t reveal the exact number