as Jaba has said, before throwing around accusations to the regulator or service providers, maybe look a little closer to home.
Have your personal details including ARN ever been present on your PC(s) or devices online? It's a more plausible assumption your details have been leaked from something you have used which has been compromised.