Modern databases do not store passwords directly in plain text. Instead, they take your password, and run an algorithm called a 'digest' on it, like SHA-1, or (the now deprecated) MD5. The idea is that if you supply the correct password, the result of the calculation will be the same as the one they have stored. That way, they don't have to store your password, but they know if you've entered the correct one.
They certainly have your username. That has to be stored in plain text. If you use your phone for bank transactions, and enter your username and password that way, it's possible that keylogging software on your phone could have gleaned the username and password. You stated you haven't clicked any shady links, but there have been reports of phone market places, such as Android's Google Play, occasionally holding malware.
However, it doesn't really sound like that's what you're hitting here. You mention a 'SIM error'. This sounds more like someone at the mobile phone company made an error which may have caused your SIM chip to become disassociated with your phone. If this is the case, your banking information isn't actually compromised. Have you checked to see if any unauthorized transactions have occurred? You haven't specified if something actually went wrong or if you're just asking this academically, because your bank told you 'if this ever happens, you're screwed'.
Many banks have an identity theft service. Many countries have laws about how these things are to be held. We're not lawyers, so you would have to investigate there and you should keep legal council if needed.
It should be also noted that a bank does not need your login information to change things in your account. They can make changes as they see fit. Your login information is only so you can manage your account remotely. They're free to charge things, move money, and tweak features in the system without needing your password, as they have direct access to the databases through their programs at the bank. If the changes were linked to a particular login, that's one thing. If changes just 'happened', that's another.
An additional angle to consider is if your password/sim stopped working, it may not be that your password ever was compromised. It may have been a social engineering attempt where an attacker convinced a banker that he or she was you, and then got them to reset your password because they 'forgot it'. This, unfortunately, is not that difficult. You can read about how this sort of attack can go down here: http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/ This one wasn't a banking compromise, but it was severe and in a similar style to what I mention.
Your bank cannot claim a complete lack of liability without knowing precisely how the attacker got control of your account. 'Not knowing the username and password' is not a blanket excuse that holds under all angles of scrutiny. Don't get me wrong, however. You can't blame them for the error without knowing what happened, either, and they have the most information, since their systems would the ones logging actions.
Update As one of the commentators pointed out, my statement about databases 'not storing passwords directly in plain text' is a simplification. A database will store whatever you tell it to. Programmers working with financial information are expected to have the sense, however, to store digests instead of plain text. You can expect that your password is not stored.