Sorry to hear about that.
Best thing to do is to call AT&T and let them know your account may have been compromised.
Files, contacts, etc can be exchanged through bluetooth. As far as your actual account, unless they have your passcode for your account, they cannot change your plan..etc.
If you call customer service they can walk you through making sure the bluetooth is unpaired and let you know the best way to proceed.
I hope it works out for you and wish you the best.