post statement with id number instead of my name

I have an existing contract with Telkom which it has never given me any problems since day one of being active. At the time of signing up for the contract, my communication preference was email option including statements and invoices. Telkom sent my statement on my post and the manner the account was sent is really going against POPI act, I was address as Mr. (my ID NUMBER) and that was visible from the outside of the account. I have sent them an email and attached a picture of the account they have sent, and also cc ICASA, the email was sent on the 29th of April 2024 and as of today I have not received any communication. My worry is in the manner they have sent my account, how many people have seen my ID number and who knows how many ***** has been now done under my name, where is protection of clients personal information in the manner my account was sent. I have the account with me if hello peter should want to see it.