Missed security update led to 9 1⁄2 hours public healthcare service outage on Oct 13

Visitors at the pharmacy at Tan Tock Seng Hospital on Oct 13, 2026, during a 9 1⁄2 hour service disruption to Singapore’s public healthcare clusters. ST PHOTO: BRIAN TEO

Published Nov 03, 2026, 01:40 PM

Updated Nov 03, 2026, 01:40 PM

A missed security update to a shared DNS service caused a 9½-hour outage across Singapore’s public healthcare system on 13 October, affecting bookings, registration, dispensing and billing.

About 4,000 outpatient appointments were rescheduled, some patients waited up to two hours, but no patient safety harm or data loss was reported.

Synapxe and the Health Ministry will review the lapse, tighten change tracking and recovery plans, and improve resilience for shared systems and future electronic medical records.

SINGAPORE - A “preventable lapse” involving a missed security update to a shared domain name system led to a 9 1⁄2 hours public healthcare service outage on Oct 13 , Parliament heard.

Affected services included appointment bookings, visitor registration, medication dispensing and billing, said Senior Minister of State for Health Tan Kiat How on Nov 3.

He added that about 4,000 outpatient appointments were rescheduled and some patients experienced delays of up to two hours. There were however no reported adverse incidents affecting patient safety as a result of the disruption.

The outage affected all three of Singapore’s public healthcare clusters – NHG Health, National University Health System (NUHS) and SingHealth.

“This was a known change and a preventable lapse,” he said, replying questions from MPs about the cause and extent of the disruption, which is the longest in recent years.

MPs Joan Pereira (Tanjong Pagar GRC) and Poh Li San (Sembawang West) asked about the reason for the disruption and whether backup systems were in place, while Dennis Tan (Hougang) asked if measures had been implemented to reduce the risk of such systemwide disruptions.

Specifically, the required security update to a shared domain name system (DNS) service was not completed before a scheduled global change, Tan said. DNS works like an address book, transforming website addresses into numerical IP addresses which systems use to locate and connect to applications.

Tan said that while national health-tech agency Synapxe had contracted a service provider to manage the necessary update, it was not carried out. Synapxe is reviewing the provider’s contractual obligations and will take appropriate action for any established lapses, he added.

“Regardless of the outsourcing arrangement, Synapxe remains accountable for the resilience of its critical systems,” he said.

Tan reiterated that the incident was not the result of a cyberattack, and that there was no unauthorised access to patient data, which was not compromised or lost.

While abnormal activity was detected, time was required to identify the underlying problem, said Tan, who is also Senior Minister of State for Digital Development and Information.

Synapxe is strengthening monitoring and fault diagnosis to enable faster recovery, he said, apologising for the inconvenience caused to patients and their families, as well as the resulting additional work for healthcare workers.

Singapore’s public healthcare systems have backup infrastructure, including two data centres. “However, both depended on the same underlying DNS service and security configuration. Switching between them would therefore not have resolved this disruption,” he said.

Synapxe will review such shared dependencies and strengthen alternative recovery arrangements, he added.

“Healthcare institutions activated downtime procedures, with additional staff supporting operations and clinicians using selected read-only patient records and manual workflows to continue essential care,” said Tan.

To strengthen resilience against such incidents, the authorities are improving the tracking and verification of critical technical changes, said Tan, adding that shared dependencies are also being addressed and recovery arrangements improved.

He added that continuity of care during such incidents is also being addressed by improving downtime systems, staff readiness and regular exercises, including for partial outages.

The Health Ministry will oversee the corrective actions and verify that they are effective, said Tan.

“Synapxe has appointed an expert panel comprising representatives from other organisations that have similar engineering profiles to review the investigation findings and proposed remediation measures and identify further improvements,” he said.

While digitalisation brings important benefits to healthcare, resilience must improve as systems become more interconnected, he said.

“We must make our technology more reliable, while ensuring healthcare workers can continue caring for patients safely even when technology fails.”

In a supplementary question, Yip Hon Weng (Yio Chu Kang) asked if having Synapxe oversee the tech functions of the three healthcare clusters posed a concentration risk.

Tan said the global DNS service shared by the clusters and their systems was a “trust anchor” – a term used for authoritative entities in computer security.

Decentralising the healthcare IT systems would not necessarily have prevented the disruption, but could instead have made diagnosis and recovery much more difficult,” he said.

Yip had also asked whether the Epic system used by private clinics here would be affected by such a concentration risk.

Tan said the authorities would look at such risks and dependencies as it sought to implement a shared electronic medical records system across providers.

Zhaki Abdullah is a correspondent at The Straits Times. He is on the health beat, in addition to occasionally covering science, environmental, tech and Muslim affairs issues.

Singapore Parliament

2026年10月13日，新加坡公共医疗服务中断9个半小时，陈笃生医院药房的访客正在排队等候。（海峡时报摄影：BRIAN TEO）

发布于2026年11月3日下午1:40

更新于2026年11月3日下午1:40

10 月 13 日，由于共享 DNS 服务的安全更新缺失，导致新加坡公共医疗保健系统中断 9.5 小时，影响了预约、登记、配药和计费。

约有 4000 个门诊预约被重新安排，一些患者等待了长达两个小时，但没有报告任何患者安全受到伤害或数据丢失的情况。

Synapxe 和卫生部将审查此次故障，加强变更跟踪和恢复计划，并提高共享系统和未来电子病历的弹性。

新加坡——国会获悉，由于共享域名系统未能及时进行安全更新，导致公共医疗保健服务于 10 月 13 日中断了 9 个半小时，这属于“可预防的疏忽”。

卫生部高级政务部长陈杰豪于11月3日表示，受影响的服务包括预约、访客登记、药品配发和账单结算。

他还补充说，约有4000个门诊预约被重新安排，一些患者的就诊时间被延误了长达两个小时。不过，此次中断并未造成任何影响患者安全的不良事件报告。

此次停电影响了新加坡所有三个公共医疗保健集团——NHG Health、国立大学医疗系统（NUHS）和新加坡保健集团（SingHealth）。

“这是一个已知的变化，也是一个可以避免的失误，”他在回答议员们关于此次中断的原因和程度的问题时说道，这是近年来持续时间最长的一次中断。

国会议员琼·佩雷拉（丹戎巴葛集选区）和傅丽珊（三巴旺西选区）询问了造成中断的原因以及是否有备用系统，而丹尼斯·陈（后港选区）则询问是否已采取措施来降低此类系统性中断的风险。

Tan表示，具体来说，共享域名系统（DNS）服务所需的安全更新在计划的全局变更之前并未完成。DNS的工作原理类似于地址簿，它将网站地址转换为数字IP地址，系统利用这些地址来定位应用程序并与之连接。

谭先生表示，虽然国家医疗科技机构Synapxe已与一家服务提供商签订合同，负责进行必要的系统更新，但更新工作并未执行。他补充说，Synapxe正在审查该服务提供商的合同义务，并将对任何已查明的违约行为采取适当措施。

“无论外包安排如何，Synapxe 仍需对其关键系统的弹性负责，”他说道。

谭重申，该事件并非网络攻击所致，患者数据没有遭到未经授权的访问，也没有被泄露或丢失。

陈先生（同时也是数字发展和新闻部高级政务部长）表示，虽然检测到了异常活动，但需要时间来确定根本问题。

Synapxe公司正在加强监测和故障诊断，以实现更快的恢复。该公司负责人表示，对于给患者及其家人带来的不便，以及由此给医护人员带来的额外工作，该公司负责人表示歉意。

新加坡的公共医疗系统拥有备用基础设施，包括两个数据中心。“然而，这两个数据中心都依赖于相同的底层DNS服务和安全配置。因此，在它们之间切换并不能解决此次中断问题。”他说道。

他补充说，Synapxe 将审查此类共同依赖关系，并加强替代恢复安排。

“医疗机构启动了停机程序，增派人手支持运营，临床医生使用选定的只读病人记录和手动工作流程来继续提供必要的护理，”谭说道。

谭表示，为了加强应对此类事件的能力，有关部门正在改进对关键技术变更的跟踪和核实，并补充说，共享依赖关系也在得到解决，恢复安排也在得到改进。

他还补充说，在发生此类事件时，医疗服务的连续性也正在得到解决，具体措施包括改进停机系统、提高员工准备水平以及开展定期演练（包括部分停机演练）。

谭表示，卫生部将监督整改措施，并核实其有效性。

“Synapxe 已任命一个专家小组，成员包括其他具有类似工程背景的组织的代表，以审查调查结果和提出的补救措施，并确定进一步的改进措施，”他说。

他表示，虽然数字化给医疗保健带来了重要的好处，但随着系统之间联系日益紧密，韧性必须得到提高。

“我们必须提高技术的可靠性，同时确保即使在技术出现故障时，医护人员也能继续安全地照顾病人。”

在补充提问中，叶鸿文（义顺选区）询问，让 Synapxe 负责这三个医疗集群的技术职能是否会造成集中风险。

Tan表示，集群及其系统共享的全球DNS服务是一个“信任锚点”——这是计算机安全领域中用来指代权威实体的术语。

他说：“将医疗保健 IT 系统分散化未必能阻止这种混乱局面，反而可能使诊断和康复变得更加困难。”

叶先生还询问，本地私立诊所使用的Epic系统是否会受到这种集中风险的影响。

谭表示，有关部门在寻求在各医疗机构之间实施共享电子病历系统时，会考虑此类风险和依赖关系。

扎基·阿卜杜拉是《海峡时报》的记者。他主要负责健康新闻报道，偶尔也报道科学、环境、科技和穆斯林事务等议题。

新加坡国会