One of The data protection officers should have been in contact you by now.
Contact for them is a generic email address
[email protected]
If you have dates, times and name of staff from the phone call then supply them. Point out the length of time you been waiting for the promised contact over the breach personal data, that is enough for identity fraud.
And that you been advised to contact the data commissioner office of the breach and the length of time so far for any contact over the issue.
By email you create a paper trail you can use if you go to ICO or DCO.
Sent from my SM-A705FN using Tapatalk