Have a Synology NAS? Ransomware Is Hitting Out-of-Date Ones. Update Today

Who this affects

Anyone with a Synology NAS (a small storage box, often called a DiskStation, that keeps family photos, files or office backups on your network): check it today, especially if you or someone else set it up so you can reach it from outside your home or office.
Small businesses that keep shared files or backups on a Synology: same advice, and check that you have a backup that isn't on the NAS itself.
No Synology NAS? Nothing to do.

Synology, the company that makes these storage boxes, is warning owners to update right away. On October 29, 2026, it said attackers are breaking into Synology devices that run out-of-date versions of their operating system, called DSM (DiskStation Manager), then scrambling the files and demanding a ransom. Victims have reported a ransomware program called “C3RB3R” asking thousands of dollars for a “decryptor.”

⚡ The short version

Update DSM to the newest version Synology offers for your model, today.
Turn on automatic updates, as Synology recommends.
Don't leave the NAS sign-in page open to the internet. Turn off router port forwarding for it if you don't need it.
Make sure you have a backup that isn't on the NAS, such as an unplugged USB drive.

Why this one matters

Synology rarely sends warnings like this. BleepingComputer notes its last one about attacks on customers' devices was in 2019.
Synology says the attackers are using a security flaw that it fixed back in December 2024, and are going after devices running out-of-date DSM.
Owners report their files renamed to end in .L0CK3D and a ransom note called read-me3.txt.
Updating fixes the flaws these attacks are reported to use, but it can't unlock files that were already scrambled. A separate backup is what gets them back.

Step 1: Check your DSM version and update

On a computer on the same network, sign in to your NAS in a web browser the way you normally do (or find it at find.synology.com).
Open Control Panel, then Update & Restore.
On the DSM Update tab, if an update is offered, install it. The NAS restarts, so pick a time when nobody needs the files. Updates can't be undone, so Synology recommends backing up first if you can.
When it's back, check the same screen again. Install any further updates until it says DSM is up to date.

Synology's warning points to its 2024 fix. Separately, the security company 360 reports the attackers are also using two newer flaws that Synology fixed in September 2026. Synology hasn't confirmed this. Either way, install the newest update for your model, not just one from 2024.

Step 2: Turn on automatic updates

In the same DSM Update tab, select Update Settings and choose Automatically install important updates (or Automatically install the latest updates). Synology recommends this so you don't miss the next fix. Automatic updates don't move you to a new major DSM version, so check this screen now and then too.

HKCERT also recommends installing Synology's PHP security updates in Package Center. It's not confirmed whether the PHP flaws they fix are linked to these attacks.

Step 3: Close the door from the internet

If you never use the NAS away from home or the office, check your router for port forwarding rules that point to the NAS (DSM usually uses ports 5000 and 5001) and remove them.
If you do need remote access, use a VPN instead of leaving the sign-in page open to the internet. HKCERT recommends not exposing NAS management pages directly to the internet.
Use a strong, unique password for the NAS admin account and turn on two-step sign-in if you haven't. Our two-step sign-in guide explains how it works.

Is your NAS too old to update?

Very old models can't run the latest DSM. If the DSM Update page says your model has no newer version, HKCERT advises planning an upgrade or replacing the device. Until then, keep it off the internet completely and keep a separate backup of anything important.

Signs your NAS has been hit

Files you can't open, renamed to end in .L0CK3D.
A file called read-me3.txt in your folders demanding payment.

See these? Unplug the NAS's network cable right away so it can't spread to backups or other computers. Pause any sync or backup jobs connected to it. Keep the ransom note and don't restart it unless you have to. Don't reset or wipe it yet, and don't pay. Paying doesn't guarantee you get your files back, and updating won't unlock files that are already scrambled. Get help from a trusted tech person before restoring from a backup.

Watch out for scams about this

Big security news brings scammers. You may get emails, texts or calls saying “your Synology was hacked” with a link to click or a number to call.

Don't click links in those messages. Update from your NAS's own Control Panel as shown above.
Never give passwords or remote access to someone who contacted you out of the blue. It's the same trick as the fake virus pop-up scam.

Have a Synology NAS? Ransomware is locking up out-of-date ones. Update it today