Seems like an attacker could run hashes for  all numbers + common names and look for matches. Then it’s just a question of compute and how far down the list of “common” names they want to go.