The Guardian's original article on this says that number was shown in documents from 2015 [1]. However, the whistleblower said that by now it should be over 230 million [2].
It's 270.000 users directly impacted. The friends of those users has also been fetched, but with a limited amount of data most of which is pulic already.
Anyone know how this number was added up? Any reason not to believe it wasn't 500 million or 5 million?