Giving out statements to unauthorised persons

Someone that is using my vehicle called in to the call centre and was given a full statement to my account with MFC without my permission. I want to know how can MFC just give out my personal information and statements to anyone who calls in? I think this is extremely unprofessional of MFC and I want to see that steps are taken otherwise I will be lodging a case against MFC.