That time ATT & Best Buy let someone steal phones on my account

As we were heading out to the restaurant for my son's 23rd birthday, his phone went dead. Since his phone is kinda old, we figured it was a fluke and went ahead and ate. (Side note, if you phone goes dead, call the phone company immediately).  After eating, we got on the phone and called to find out someone had just upgraded my son's phone, and "purchased" two more phones on my account that I would have to pay for.

I caught it quick so it will be OK... but...

Folks are not doing their jobs. That person either had a fake ID or knew my PIN, but probably not both.  Anytime I have to do anything on my account, I have to give my first born's blood type, but this person could waltz into Best Buy and get 3 phones in my name and go about their happy business.... that pisses me off.

But OK... I spoke to pre-fraud and will speak to fraud in the morning.  They re-simmed my son's existing phone so his phone is usable... and the guy at the store had me change my password and suggested I manage my account online... I wasn't sure what he meant, but I figured out how to disconnect and block those phones online tagging them as stolen... I was told don't worry about it, but I could not sleep after reading that someone could possibly use the phones to get into my personal information, so I took my own steps.

So, ATT?  What's up?  Best Buy... Really?

I am wondering if it is an inside job on either side.  My son did buy the phone that is now out of contract at Best Buy... did someone access that info?  Or... did the one of the two people who I upgraded my service with last month (who buy the way did not finish the orders, I had to call 3 time)... did one of them use my info to steal phones.

I would like to know.

oh, and I will be following the steps in this article tomorrow. https://www.ftc.gov/news-events/blogs/techftc/2016/06/your-mobile-phone-account-could-be-hijacked-identity-thief