And not all 9-digit numbers are used, so there are fewer than a billion. It sucks when organizations store them because the search space is so small it's relatively easy to unhash them in a stolen database.