Synology has warned customers that ransomware attackers are targeting Network Attached Storage (NAS) devices by exploiting a vulnerability in DiskStation Manager (DSM) that was patched in December 2024. The company said the attacks are aimed at encrypting business data and demanding ransom from affected organisations.

What happened

According to Synology, threat actors have been observed targeting devices that still run outdated DSM versions. The issue is not described as a newly discovered flaw: the vulnerability had already been patched, but systems that were not updated remain exposed.

This is a common pattern in ransomware operations. Attackers often look for internet-accessible appliances and storage systems that businesses rely on for shared files, internal documents, media assets, and backups. When these systems are not patched promptly, they can become a direct route to encryption, business disruption, and data recovery costs.

Why it matters for European businesses

For many small and mid-sized companies, a NAS device is more than simple storage. It may hold operational files, customer documents, creative assets, internal records, CCTV footage, or backup repositories. If ransomware reaches that environment, the impact can go beyond temporary file loss and affect day-to-day operations, order processing, customer service, finance teams, and IT recovery efforts.

The warning is especially relevant for organisations that use NAS appliances as a central file server without strong access controls or without a tested recovery plan. A patched vulnerability being used in active attacks is also a practical reminder that patch management delays create avoidable exposure, even when the vendor has already released a fix.

For European businesses, the consequences may extend beyond operational downtime. If encrypted or inaccessible systems contain personal data, regulated information, or critical business records, the incident could also trigger internal compliance reviews and breach-response processes depending on the circumstances.

Who may be affected

• SMEs using Synology NAS for shared file storage, internal collaboration, or departmental data.
• E-commerce businesses storing product assets, order exports, logs, or local backups on NAS devices.
• Creative, marketing, and digital teams managing large media libraries and client project files.
• IT teams and managed service providers responsible for patching, remote access, and backup integrity.
• Regulated businesses that keep sensitive records or personal data on NAS systems.

The risk is likely highest where devices are exposed to the internet, are running older DSM versions, or are treated as backup targets without sufficient segmentation and recovery testing.

What companies should consider

• Update DSM promptly on all Synology devices and verify that no unsupported or forgotten systems remain in use.
• Review internet exposure and limit direct remote access to NAS management interfaces wherever possible.
• Audit backup strategy to confirm that backup copies cannot be easily encrypted from the same attack path.
• Test recovery procedures so teams know how quickly critical files and systems can be restored without paying a ransom.
• Check authentication and admin access, including privileged accounts, remote administration settings, and unnecessary services.
• Monitor vendor advisories for further technical guidance, indicators of compromise, or additional mitigations.

While Synology's warning is specific to DSM, the broader lesson applies to many business systems: storage appliances, backup platforms, and edge devices should be treated as critical infrastructure, not passive hardware. When patching is delayed, they can become a high-value ransomware entry point.