Synology NAS Security: Why Backups Alone May Not Protect Your Business Data
Many Hong Kong SMEs use NAS to store shared files, customer data, and accounting records, and also centrally store computer or server backups on the NAS. The equipment operates normally every day, and the backup work shows as successful every day, which can easily lead people to believe that the data is adequately protected.
But if the NAS itself is compromised, can these files and backups still be safely retrieved?
The recent ransomware attack warning issued by Synology serves as a reminder to enterprises that NAS security requires continuous management, and the effectiveness of backups ultimately depends on whether a recovery is possible.
What did Synology say in its warning this time?
On October 29, 2026, Synology issued an official announcement stating that attackers were exploiting a previously patched vulnerability to target devices still using older versions of the DSM system. The attackers aimed to encrypt data and demand ransom. Synology urged users of affected versions to update DSM as soon as possible and to refer to the Synology-SA-24:20 security bulletin.
In addition, Synology has released a security update for the PHP2Shell vulnerability. The official explanation is that its impact is limited to systems running specific PHP dependencies, and needs to be checked and addressed based on the actual installed dependencies.
These two security issues should be understood separately. It is wrong to assume that all Synology NAS devices are affected by the same vulnerability based solely on ransomware cases circulating online.
For businesses, the most practical action is to have IT personnel check the device version, installed packages, external connections, and backup protection, rather than judging security solely based on the brand or model.
1. The fact that the NAS is still working normally does not mean that the security update is complete.
NAS devices typically operate for extended periods, and businesses may worry that updates will require restarting and affect shared files, thus delaying their implementation.
However, even after vulnerabilities have been disclosed and patches have been released, devices that have not yet been updated may still become targets for attacks.
During the review, it's not enough to just look at the major DSM version, such as "DSM 7 is already in use." IT personnel need to verify the complete version and update number, and confirm whether it meets the patch requirements according to the official announcement.
In addition to the system, the following should also be checked:
Are there any security updates for the installed packages?
Are unused packages still enabled?
Who receives and follows up on update notifications?
Has the equipment stopped receiving safety support?
Enterprises should assign responsible persons and maintenance schedules for security updates, and confirm that shared files, backups and necessary services are working properly after the update.
2. Facilitating remote access also requires managing external connections.
To make it easier for colleagues to work from home or access documents when they are out and about, some companies set up router port forwarding, allowing the NAS management interface or other services to connect directly from the Internet.
These settings may have been in use for many years, the person who originally set them up may have left the company, and the services that were originally required may have been discontinued, but the external connection is still retained.
Regular check-ups are recommended:
Which NAS services can be connected via the Internet?
What forwarding rules are retained by routers and firewalls?
Should the management interface still be made directly accessible to the public?
Can remote access be provided through a controlled VPN or other suitable means?
Whether the management account, permissions, and multi-factor authentication settings are appropriate.
Multiple authentication methods can help protect accounts, but they cannot replace vulnerability patching. External services, system updates, and account management need to be reviewed together.
3. RAID, synchronization, and snapshots each provide different levels of protection.
The common understanding is that "a NAS has several hard drives, and if one of them fails, the data will not be lost."
RAID can improve fault tolerance in the event of hard drive failure, but changes may still be reflected throughout the entire storage system when files are deleted, overwritten, or encrypted.
Synchronization also has similar limitations. If a file is encrypted and synchronized to another location, and the destination does not have available historical versions or protection mechanisms, the other data may also be affected.
Snapshots can help restore data to an earlier state, but you still need to confirm the retention period, deletion permissions, and device-supported protection features. Snapshots located on the same device as the official data also need to be used in conjunction with other backup arrangements.
Enterprises should be clear about which type of risk each function protects and in which situations still require independent backup for recovery.
4. Storing backups on the same NAS may expose you to shared risks.
Suppose the company backs up computers to the NAS every day and also stores important files on the NAS.
If a NAS is compromised and the attacker gains sufficient privileges, official files and backups may be affected simultaneously.
Even if there is an external USB hard drive, if it is connected for a long time and can be modified by the system, the risk cannot be considered isolated simply because there is "an extra hard drive".
When designing backups, the following should be considered:
Keep versions from multiple points in time to avoid having only the latest version.
Combine with offline copies, off-site backups, or appropriate immutable storage protection.
Restrict permissions for modifying and deleting backups of daily accounts and official systems.
Set the backup frequency and retention time according to the importance of the data.
Regularly check failure notifications, storage capacity, and retention policies.
The specific combination should be determined based on the company's acceptable data loss and downtime. Accounting data, customer documents, and historical archives may not be suitable for the exact same arrangement.
5. After a successful backup, you should test whether you can restore the work.
The backup system shows success, indicating that the work has been completed as set up; however, the company still needs to verify whether the required data can be retrieved in the event of a real incident.
For example, the steps required to retrieve an Excel file may be completely different from those required to restore an entire accounting system. In addition to data, it may also involve applications, settings, permissions, and other dependent services.
The restoration test should answer the following questions:
Is it possible to find a complete version of the document from before the accident?
Can the restored file be opened normally?
Is the system working properly and can colleagues use it?
Are the required account, password, and encryption key complete for the recovery?
How long will it actually take to restore basic operations?
The boss and management can ask this question first:
"If the NAS is unavailable today, how long of a shutdown is the company willing to accept, and how much data will be lost?"
The answer will directly affect backup design, equipment budget, and recovery arrangements.
If a file is found to be encrypted, what should be done?
If you encounter a large number of files that cannot be opened, file names that have changed abnormally, or ransomware messages, you should contact IT personnel immediately for assistance.
Priority tasks include isolating affected equipment, assessing whether related computers and backups are affected, and suspending synchronization work that may spread damaged data as needed.
At the same time, system logs, ransom messages, and related time records should be retained to avoid initializing the NAS, reinstalling the system, or deleting a large number of files, so as not to destroy the data needed for investigation and recovery.
Before restoring services, it is also necessary to confirm that the cause of the intrusion has been addressed and to select a reliable and complete backup version to avoid being affected again after restoration.
NAS security is an ongoing enterprise IT management task.
NAS installation complete, just the beginning.
Subsequent system updates, package management, account permissions, external connectivity, backup checks, and restore tests all require ongoing responsibility from someone.
For SMEs, the questions worth asking are not only "whether there are backups", but also: whether the backups can be preserved in the event of an incident, and whether the company can resume operations within an acceptable timeframe.
i-Success provides IT support and management services to Hong Kong SMEs, assisting them in reviewing NAS, network, and backup arrangements and proposing improvement directions based on actual business needs.
If you would like to know about the security and backup status of your company's existing NAS, please feel free to contact us.
Official Reference
Synology Ransomware Warning (October 29, 2026):
Synology-SA-24:20 DSM Security Bulletin:
Synology PHP2Shell Official Documentation:
Synology-SA-26:14 PHP2Shell Security Notice:
The information in this article is current as of October 30, 2026; please refer to the latest official announcements for affected versions and update arrangements.
