Facebook has confirmed that hundreds of millions of user phone numbers were left in an unprotected server, including several million British details.