Just because you deactivated/suspended the account (3G service is not working), it won't block any wifi access.. so if they have your phone, yes, they can get to anything that is/was on it.
Originally Posted by Jfos1058
I assume from the way you asked the question that there was no passcode on it, correct? Did you enable Find My Phone? Do you have the ability to wipe the content via that app? If not, you could be in for a tough time... all of your contacts, your email, and any sites with saved passwords/social network apps, etc are all exposed to whomever has your phone.