iCloud hacked

As I believe you have already surmised, the "hack" most likely was to your Apple ID. Even with two-factor authentication, it is still possible if someone knows your ID's password and has a device that is listed to your account to receive the verification codes they basically can access your iPhone through your account.

Apple provides the following support article on this topic: If you think your Apple ID has been compromised - Apple Support

A bit too late now, but a good going-forward strategy would be to immediately change your Apple ID password at the first instant you believe that you have been hacked. Then contact the Apple Apple ID Account Security team for further assistance. To contact them, clickhereand pick a method; if that page doesn't list one for your country or you're unable to call, fill out and submitthis form.

Your phone was not hacked. It just didn't happen.

It's highly likely that your Apple ID was compromised. In fact, I wouldn't be surprised if your Apple ID, and one or more email accounts was compromised.

You need to read this article: If you think your Apple ID has been compromised - Apple Support

If they had all the information you claim they did, then they did not get them from your iCloud account. Your icloud account was likely one of many that was compromised.

You have bigger problems that the supposed 'security' of your phone.

Without using iCloud or an Apple ID at all, the phone is as secure as you want to make your passcode. Use a complex long password to lock the phone and keep it a secret. If you do that, then there is no way for anyone to gain access to the data on it without the password. You'll be seriously compromising the functionality and utility of the phone by not using an Apple ID or iCloud, but hey... that's up to you.

I submit to you that no Apple product or service was the source of your problems. They were ancillary to the actual problem. Given the information obtained, either you have been storing information in an unsecured place out there on the interwebtubes, someone you know who would have physical access to certain things that would allow them to gain access to this information is ruining your life, or you fell victim to one or more phishing scams and voluntarily gave critical information to the scammers.

You need to take action to deal with this, possibly getting professional assistance. And I'm not talking about your text messages and social media being compromised. Loss of control of your SSN, credit cards, etc could potentially ruin your life.