In the UK, start with the data. Go to the ICO website and read the stuff about data protection and subject access requests.
Then, launch your subject access requests against all involved - the issuer of the dodgy ref., and the agencies, and the employers.
They have limited time to reply, but don't expect instant replies.
Get everything that has been said in writing.