Facebook's estimate was far higher than news reports suggesting 50 million users may have been affected in the privacy scandal which has roiled the company and sparked questions for the entire internet sector on data protection.
Zuckerberg told reporters on a conference call he accepted responsibility for the failure to protect user data but maintained that he was still the best person to lead the network of two billion users.
"I think life is about learning from the mistakes and figuring out how to move forward," he said in response to a question on his ability to lead the company.
"When you're building something like Facebook which is unprecedented in the world, there are things that you're going to mess up... What I think people should hold us accountable for is if we are learning from our mistakes."
Zuckerberg said 87 million was a high estimate of those affected by the breach, based on the maximum number of connections to users who downloaded an academic researcher's quiz that scooped up personal profiles.
"I'm quite confident it will not be more than 87 million, it could well be less," he said.
To remedy the problem, Zuckerberg said Facebook must "rethink our relationship with people across everything we do" and that it will take a number of years to regain user trust.
The new estimate came as Facebook unveiled clearer terms of service to enable users to better understand data sharing, and as a congressional panel said Zuckerberg would appear next week to address privacy issues.
Facebook has been scrambling for weeks in the face of the disclosures on hijacking of private data by the consulting group working for Donald Trump's 2016 campaign.
The British firm responded to the Facebook announcement by repeating its claim that it did not use data from the social network in the 2016 election.
"Cambridge Analytica did not use GSR (Global Science Research) Facebook data or any derivatives of this data in the US presidential election," the company said in a tweet. "Cambridge Analytica licensed data from GSR for 30 million individuals, not 87 million."
Zuckerberg on the Hill
Facebook's chief technology officer Mike Schroepfer meanwhile said new privacy tools for users of the huge social network would be in place by next Monday.
"People will also be able to remove apps that they no longer want. As part of this process we will also tell people if their information may have been improperly shared with Cambridge Analytica," he said in a statement.
Schroepfer's post was the first to cite the figure of 87 million while noting that most of those affected were in the United States.
Facebook also said its new terms of service would provide clearer information on how data is collected and shared without giving the social network additional rights.
Earlier Wednesday, the House of Representatives' Energy and Commerce Committee announced what appeared to be the first congressional appearance by Zuckerberg since the scandal broke.
The April 11 hearing will "be an important opportunity to shed light on critical consumer data privacy issues and help all Americans better understand what happens to their personal information online," said the committee's Republican chairman Greg Walden and ranking Democrat Frank Pallone in a statement.
The Facebook co-founder is also invited to other hearings amid a broad probe on both sides of the Atlantic.
Deleting Russian 'trolls'
Zuckerberg told the conference call he was committed to ensuring that Facebook and its partners do a better job of protecting user data, and that it must take a more serious approach after years of being "idealistic" about how the platform is used.
"We didn't take a broad enough view on what our responsibility is, and that was a huge mistake. It was my mistake."
He said that while "there are billions of people who love the service," there is also a potential for abuse and manipulation.
"It's not enough just to give people a voice," he said. "We have to make sure people don't use that voice to hurt people or spread disinformation."
Late Tuesday, Facebook said it deleted dozens of accounts linked to a Russian-sponsored internet unit which has been accused of spreading propaganda and other divisive content in the United States and elsewhere.
The social networking giant said it revoked the accounts of 70 Facebook and 65 Instagram accounts, and removed 138 Facebook pages controlled by the Russia-based Internet Research Agency (IRA).
The agency has been called a "troll farm" due to its deceptive post aimed at sowing discord and propagating misinformation.
The unit "has repeatedly used complex networks of inauthentic accounts to deceive and manipulate people who use Facebook, including before, during and after the 2016 US presidential elections," said a statement Facebook chief security officer Alex Stamos.
