A nine-and-a-half-hour computer system outage affected Singapore’s three public healthcare clusters on 13 October after an appointed service provider failed to complete a required security update for the Domain Name System in time, an investigation found.
The Ministry of Health (MOH) will oversee the implementation of corrective measures and verify their effectiveness.
Senior Minister of State for Digital Development and Information and Health Tan Kiat How told Parliament on Tuesday (3 November), in response to questions from government and opposition Members of Parliament, that the disruption had caused inconvenience and concern for patients and their families, and added to healthcare workers’ workload.
Tan said: “We apologise for this. This incident should not have happened.”
The investigation found that the outage across the three healthcare clusters was not a cyberattack. There was also no unauthorised access to patient data, compromise of patient data security or loss of data.
The incident arose because a security update required for the Domain Name System (DNS) service was not completed before a scheduled global change took effect. DNS acts as the internet’s address book, helping systems locate and connect to applications.
The update had been made known in advance, so this lapse could have been avoided.
Synapxe, the national health technology agency, had appointed a service provider to carry out the required update, but it was not performed. Synapxe is reviewing the vendor’s contractual obligations and will take appropriate action over any confirmed lapses.
Tan said that regardless of any outsourcing arrangements, Synapxe remains accountable for the resilience of critical systems.
He said monitoring systems had detected unusual activity, but identifying the root cause and safely restoring services still took time. Synapxe is strengthening its monitoring and diagnostic capabilities to speed up system recovery.
Singapore’s public healthcare system has backup infrastructure, including two data centres. However, both rely on the same underlying DNS service and security configuration. Switching between the two data centres therefore could not resolve this outage.
Synapxe will review this reliance on a single system and strengthen alternative recovery arrangements.
Affected services that day included appointments, visitor registration, medication dispensing and billing. Healthcare institutions activated downtime contingency procedures and deployed additional staff to support operations. Clinical staff used the limited read-only medical records available and manual processes to maintain essential care.
About 4,000 outpatient appointments had to be rescheduled, and some patients faced waiting times of up to two hours longer. However, the authorities received no reports of adverse patient safety incidents attributable to the outage.
Tan said MOH and Synapxe are strengthening system resilience in three areas.
To prevent disruptions, they are improving the tracking and verification of critical technical changes.
To contain the impact, they are reviewing reliance on a single system and improving recovery arrangements.
To ensure continuity of care, they are improving downtime contingency systems, strengthening staff preparedness and conducting regular drills, including exercises for partial system outages.
MOH will oversee the implementation of a series of corrective measures and verify their effectiveness.
Synapxe has appointed an expert panel to review the investigation findings and proposed remedial measures, and identify areas for further improvement. The panel comprises representatives from other organisations with similar engineering and technical expertise.
