yeah might need first + last, even then it could still be brute forced eventually… so single users could be cracked if someone was motivated enough 

 The only other thing I could think of is doing a hash of a range of numbers 🤔 so cracking doesn’t reveal the exact number