Unsecure Service Provider (DATA) - Internal ***** causing personal damage

I've been blacklisted for a *****ulent account, that I was told closed.

Timeline:

2 June - a *****ulent account is opened on my name, without my knowing. 8 July - a debit order runs on the account. I call FNB who blocks future debit orders from Vodacom and informs me that I need to send documents to Vodacom's ***** department. The top call query received by FNB in July. 9 July - I send the needed documents to Vodacom and get the following case number EC-1M45-2NVWGS. 14 August - I follow up on my case to ensure it has been resolved - no answer other than "we're still investigating" long after the 14 working days since I've submitted the issue. 1 October - I receive a final letter of demand - I follow up on my case again. 2 October - I receive confirmation that "In the month of June 2023, Vodacom detected an incident which involves the reprocessing of your personal information that resulted in the activation of a new account under your name... and " Vodacom has proactively taken steps to rectify and remove the *****ulent account." 6 November - I get a call from a collections agency that informs me I'm black listed.

This is extremely unacceptable. How was my data so easily accessed? If the account was removed from my name, why am I being black listed?