A major telehealth provider faces tough questions after a notorious extortion gang accessed user data via a third-party support platform.