Unauthorised Debit Order

A Durban based company by the name of LUVMORE made an unauthorised debit on my account through the South African Payment Exchange. My ID number was used as a reference in the debit order. I called this company (LUVMORE) to inquire about what the debit was for and how they got access to my ID number. The debit was allegedly for some benefit or discount card and they have a database that has ID numbers. What scares me is this database of our ID numbers, does this mean any random company can access our ID numbers all willy nilly? Companies like LUVMORE SHOULD BE BLACKLISTED and more should be done to secure our personal information such as our ID numbers.