Updoc hit by data security incident after unauthorised third-party system access

Updoc is notifying its clients of a significant data security incident after an unauthorised threat actor gained access to a third-party system used by the company to support its operations.

 

Updoc is an Australian online telehealth platform that allows patients to access healthcare services remotely through digital consultations with registered medical practitioners. The platform provides services such as online doctor appointments, medical certificates, prescriptions (where clinically appropriate), referrals, and other healthcare-related support.

 

Recently, in an email sent to its customers, Updoc said that on July 31, it identified unauthorised access to a third-party system that the company uses to support its operations. The telehealth provider immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

It also took steps to secure the affected network and notified relevant law enforcement authorities about the incident.

 

While the full details of the incident are yet to be disclosed, Updoc has confirmed that the unauthorised access was contained and isolated. The information potentially affected included contact details, such as names, email addresses, and postal addresses.

 

The company confirmed that its internal systems were not compromised and that the incident did not affect sensitive information, including financial data, payment details, or health records.

 

“We took immediate actions to block the unauthorised access and can confirm there was no evidence of access after the initial event,” Updoc said.

 

Updoc has advised customers that no immediate action is required, but they should remain vigilant for potential scam attempts or fraudulent communications that may appear to be related to the incident. Customers are encouraged to exercise caution when receiving any unexpected emails, letters, or messages regarding their accounts. Any suspicious correspondence should be reported to Updoc, and customers are reminded that the company will never request passwords or other sensitive login information via email.