Millions of Facebook user phone numbers exposed online, security researchers say