Official numbers (calculated by the police) say more than 2 million country-wide. I don't see anyone claiming "1 million people in São Paulo" to be false, except government-sponsored media.