A service provider’s failure to complete a required security update caused the 13 October public healthcare outage, which lasted about nine and a half hours and forced about 4,000 outpatient appointments to be rescheduled.
Senior Minister of State for Health Tan Kiat How disclosed the findings in Parliament on 3 November.
“We apologise. It should not have happened,” he said.
Patients Faced Delays Of Up To Two Hours
The outage affected NHG Health, the National University Health System and SingHealth, disrupting appointment bookings, visitor registration, medication dispensing and billing.
Some patients experienced delays of up to two hours. Staff used manual procedures and some patient records that could be viewed but not edited to continue essential care.
Tan said no adverse patient-safety incidents were attributed to the disruption. Investigators also found no cyberattack, unauthorised access to patient data, or data compromise or loss.
Why Backup Data Centres Could Not Help
The missed update involved a shared Domain Name System (DNS) service, which helps computer systems find and connect to applications. It was required before a scheduled global change.
Both backup data centres relied on the same DNS service and security configuration, so switching between them would not have resolved the problem.
Monitoring detected abnormal activity, but identifying the cause and restoring services safely took time.
Synapxe Remains Accountable
Tan said Synapxe remains accountable despite outsourcing the update. It is reviewing the provider’s contractual obligations and will act on established lapses.
Corrective work covers technical-change checks, shared dependencies, recovery arrangements and procedures for continuing care during outages.
MOH will oversee these measures and verify their effectiveness. Synapxe has also appointed an expert panel to assess the findings and proposed fixes.
