Phone numbers are only 10 digits. That is only 10 billion combinations. For SHA1 which pwned passwords uses that it should only take a couple seconds on a decent system. Even with SHA256 it could be done in like a minute.