Missed security update led to healthcare service outage

While abnormal activity was detected, time was required to identify the underlying problem, said Tan, who is also Senior Minister of State for Digital Development and Information.

Synapxe is strengthening monitoring and fault diagnosis to enable faster recovery, he said, apologising for the inconvenience caused to patients and their families, as well as the resulting additional work for healthcare workers.

Singapore’s public healthcare systems have backup infrastructure, including two data centres.

“However, both depended on the same underlying DNS service and security configuration. Switching between them would therefore not have resolved this disruption,” Tan said.

Synapxe will review such shared dependencies and strengthen alternative recovery arrangements, he said.

“Healthcare institutions activated downtime procedures, with additional staff supporting operations and clinicians using selected read-only patient records and manual workflows to continue essential care.”

To strengthen resilience against such incidents, the authorities are improving the tracking and verification of critical technical changes, said Tan, adding that shared dependencies are also being addressed and recovery arrangements improved.

He said that continuity of care during such incidents is also being strengthened by improving downtime systems, staff readiness and regular exercises, including for partial outages.

The Health Ministry will oversee the corrective actions and verify that they are effective, Tan said.

“Synapxe has appointed an expert panel comprising representatives from other organisations that have similar engineering profiles to review the investigation findings and proposed remediation measures and identify further improvements,” he said.

While digitalisation brings important benefits to healthcare, resilience must improve as systems become more interconnected, he added.

“We must make our technology more reliable while ensuring healthcare workers can continue caring for patients safely even when technology fails.”

In a supplementary question, Yip Hon Weng (Yio Chu Kang) asked whether having Synapxe oversee the tech functions of the three healthcare clusters posed a concentration risk.

Tan said the global DNS service shared by the clusters and their systems was a “trust anchor” – a term used for authoritative entities in computer security.

Decentralising the healthcare IT systems would not necessarily have prevented the disruption, but could instead have made diagnosis and recovery much more difficult, he said.

Yip also asked whether the Epic system used by private clinics here would be affected by such a concentration risk.

Tan said the authorities would look at such risks and dependencies as it sought to implement a shared electronic medical records system across providers.

The October disruption occurred after a previous incident in November 2023, when the websites of public hospitals and polyclinics here were hit by a seven-hour disruption.

The 2023 incident was caused by a distributed denial-of-service attack, in which attackers flooded servers with internet traffic, preventing users from accessing online services.

Synapxe said then that it would strengthen its system design for greater resilience against new forms of such attacks in the future.