The Guardian's original article on this says that number was shown in documents from 2015 [1]. However, the whistleblower said that by now it should be over 230 million [2].
It's 270.000 users directly impacted. The friends of those users has also been fetched, but with a limited amount of data most of which is pulic already.
[1] https://www.theguardian.com/news/2018/mar/17/cambridge-analy...
[2] https://www.theguardian.com/news/2018/mar/17/data-war-whistl...