Synology warns of ransomware attacks on NAS devices running outdated DSM
On 29 October Synology urged owners to update DiskStation Manager after attackers began encrypting data on devices that never received a fix issued in December 2024.
By Andrew Ingleton · Published
If you run a Synology NAS and have not updated it for a while, now is the time. In a press release dated 29 October 2026, Synology said threat actors are carrying out ransomware attacks against devices running outdated versions of DiskStation Manager (DSM), exploiting a vulnerability that the company patched in December 2024.
What Synology has said
The statement is short. Synology says the attackers are targeting devices that were never updated after the fix, with the aim of encrypting the data stored on them and demanding a ransom. It tells owners of vulnerable versions to update DSM immediately and to turn on automatic updates so the device stays current. It points to security advisory Synology-SA-24:20 for details.
The release does not name the affected DSM versions, the number of devices hit, or the attackers. We have therefore not tried to guess any of those: check the advisory for the exact fixed builds for your model.
Why this matters for a home server
A NAS is often where a household keeps its photos, documents and backups, and many are reachable from the internet for remote access. An unpatched device in that position is exactly what ransomware crews look for. The fix has been available for almost two years, which is a reminder that the danger is rarely a brand-new flaw: it is the update nobody installed.
This also follows our earlier coverage of PHP2Shell, when Synology extended security updates to end-of-life DSM versions on 22 October. Devices that no longer receive updates are a separate, growing problem.
What to do today
- Update DSM. Open Control Panel, then Update & Restore, and install the latest version offered for your model.
- Enable automatic updates in the same screen, at least for security fixes.
- Check how your NAS is exposed. If you do not need it reachable from the internet, close the port forwards and use a VPN to reach it instead.
- Keep a backup that ransomware cannot reach: an offline or off-site copy, or snapshots that cannot be deleted from the NAS login.
- Use strong, unique admin passwords and turn on two-factor authentication.
If your model is too old to receive current DSM updates, plan its replacement and keep it off the internet in the meantime. Our look at the DiskStation neo+ range covers the cheaper end of Synology's current line-up.
