Breach of personal data

I returned a phone to Takealot a few months ago. It was not working at all. Went dead not charging or switching on. I could not do a reset on it and it was returned as is, with all my personal data still on it. Today I get a call from a random stranger, that bought the phone on a auction. All my personal data was still on the phone. From passwords to banking apps. How is it possible for a company as big as Takealot to be this reckless with peoples personsl data? Very upset as my personal information was breached.