Short answer
On October 29, 2026, Synology warned that ransomware is hitting NAS devices running outdated DSM software and urged owners to update. Security firm 360 links cases to C3RB3R, which adds a .L0CK3D extension to files, though sources disagree on the entry point.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Synology |
|---|---|
| Incident type | Ransomware |
| Status | Confirmed by the organization |
| Sector | Network storage hardware (consumer and small business NAS) |
| Country | Taiwan |
| Detected | 2026-10-29 |
| Disclosed | 2026-10-29 |
| People or records affected | Not stated. Synology did not publish a victim count. |
What data was exposed
- Files on affected NAS devices are encrypted and renamed with a .L0CK3D extension, according to security firm 360.
- No report reviewed says the attackers stole data. The ransom note claims recovery is impossible without them.
What Synology said
On October 29, 2026, Synology urged NAS owners to update DiskStation Manager (DSM) after ransomware operators targeted outdated installations, according to TMC Insight. GridinSoft’s write-up says Synology described attackers exploiting a vulnerability it patched in December 2024 (the advisory page itself dates to November 2024) and pointed owners to advisory Synology-SA-24:20. TMC Insight also cites a separate 2026 advisory, SA-26-14, on critical DSM flaws. Synology did not name a specific CVE for each attack and did not publish how many devices were hit.
We opened that advisory on Synology’s site. It lists three DSM flaws published on November 5, 2024, including a critical remote code execution bug (CVE-2024-10441), and lists fixed builds for DSM 7.2.2, 7.2.1, 7.2, 7.1 and 6.2. The advisory itself does not mention ransomware.
The ransomware name
Security firm 360 said its response service received multiple requests involving Synology NAS devices during October, and linked them to C3RB3R, a Cerber variant, GridinSoft reports. Encrypted files get a .L0CK3D extension (with a zero), and a note named read-me3.txt lands in affected folders. So the two names in circulation describe one thing in these sources: C3RB3R is the malware, .L0CK3D is the file extension. Synology’s own statement, as relayed by TMC, did not name a ransomware family.
Where the sources disagree
360 attributes its cases to CVE-2026-13639 and CVE-2026-13684, which Synology fixed in September 2026 under advisory SA-26:13. Synology’s statement points to the older December 2024 flaw. GridinSoft notes it is unclear whether the two accounts cover the same victims or the same entry route. We treat the entry point as unresolved.
Some older models cannot move past DSM 7.1, 6.2 or 5.2, TMC notes, so for those devices a plain update may not be possible. Replacing the device or taking it off the internet may be the realistic option.
What owners should do
If your NAS is unaffected, update now, enable automatic updates, and stop exposing DSM directly to the internet. Snapshots stored on the same NAS give limited protection, so keep a separate offline or immutable backup.
If your NAS is already locked, isolate it and keep the evidence before touching anything. The ransom note offers a test decryption and a Tor payment page. GridinSoft characterizes those claims as a sales pitch, not verified recovery advice.
Anyone who posts about a locked NAS tends to attract fake helpers. Our guides on tech support scams, recovery scams and phishing messages show what those approaches look like. For general cleanup steps, see what to do after a data breach. More incidents are in the breach archive.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake 'Synology support' or 'data recovery' services that cold-call or message victims and ask for remote access or upfront payment.
- Phishing emails posing as Synology security alerts with a link to a fake DSM update or login page.
- Recovery scams: people who post that they can decrypt files for a fee, then disappear. Patching does not decrypt files already encrypted.
- Ransom payment pages on Tor that promise a working decryptor. The note's claims are the attackers' sales pitch and are not verified.
What to do if you are affected
- 01Update DSM to the latest version supported for your model and turn on automatic updates.
- 02Remove direct internet exposure of DSM and packages. Use a VPN for remote access instead of opening ports.
- 03If you see .L0CK3D files or a read-me3.txt note, disconnect the NAS from the network and keep the ransom note, sample files, logs and DSM version.
- 04Contact Synology Support or a professional incident responder before resetting or rebuilding the device.
- 05Restore only from backups that predate the attack and are intact, into a clean, secured environment. Keep an offline or immutable backup going forward.
- 06Do not pay without advice. Payment does not guarantee working decryption.
Frequently asked questions
Is there ransomware targeting Synology NAS devices in 2026?
Yes. Synology said on October 29, 2026 that ransomware operators are attacking devices running outdated DSM versions, and it urged owners to update.
What is C3RB3R ransomware?
According to security firm 360, as relayed by GridinSoft, C3RB3R is a Cerber variant that adds the .L0CK3D extension to encrypted files and leaves a ransom note called read-me3.txt.
What is the L0CK3D ransomware on Synology?
In the sources we reviewed, L0CK3D (with a zero) is the file extension that C3RB3R appends to encrypted files. We found no evidence it is a separate group.
Which Synology vulnerability is being exploited?
Sources disagree. Synology points to a flaw patched in December 2024 (advisory SA-24:20). Firm 360 names CVE-2026-13639 and CVE-2026-13684, fixed in September 2026. It is unclear whether these describe the same victims.
Can I decrypt Synology files locked by ransomware?
Updating DSM does not decrypt files already encrypted. Check for intact backups or snapshots from before the attack and get help from Synology Support before rebuilding.
Sources
- Synology SA-24:20 (DSM, Pwn2Own 2024) security advisory, Synology, 2025-03-28
- Synology Pushes DSM Updates After Ransomware Targets Older Systems, TMC Insight, 2026-10-29
- Synology C3RB3R Ransomware: Locked NAS Files and Patch Advice, GridinSoft, 2026-10-29
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.