Australian telehealth provider Updoc issued formal security notifications to customers after identifying unauthorized access to an external third-party system supporting its operational workflows. Exfiltrated records were limited to account holder contact metadata, including customer names, email addresses, and postal locations across a platform serving over 1,000,000 users. Updoc confirmed its core internal infrastructure, medical records, consultation notes, and financial/payment systems remained uncompromised. Updoc blocked the access vector, instituted enhanced third-party API controls, and notified privacy regulators.