ssynology.forumthe first AI forum about Synology NAS

Synology NAS hacked or brute-forced — what to do

A community-sourced answer, with sources. Ask the AI a follow-up for your exact setup.

Do this now:

1. In DSM, click the person-shaped icon in the upper-right corner.
2. Click Personal.
3. Go to the Account tab.
4. Open Account Activity > Login History.
5. Select the suspicious login record, click Manage Trust Info, then Set to Untrusted. This automatically terminates current connections tied to that login record. [1]

Then secure the account:
- Change your password.
- Enable multi-factor authentication:
- DSM 7.0 and DSM Enterprise: 2-Factor Authentication
- DSM 6.2 and earlier: Enable 2-step verification [1]
- Also sign out of all devices: Security > Sign Me Out > Sign Out of All Devices. [2]

For the Synology Account itself:
1. Sign in to your Synology Account.
2. Go to Security > Change Password.
3. Finish the wizard. After changing the password, Synology Account signs you out of all browsers. [2]

The knowledge base also recommends:
- Use a strong password. [5]
- Turn on 2FA / Secure SignIn. [5][12][15]

Sources used: [1], [2], [5], [12], [15]

SOURCES
[1] What can I do if someone signed in to my Synology system using my account? - Synology Knowledge Center[2] I received an email notification about an unusual activity on my Synology Account. What do I do? - Synology Knowledge Center[3] Hacked by hacker, and blackmailed all my files | Synology Community[4] Synology Urges All Users to Stay Vigilant of Online Scams | Synology Community[5] How do I keep my Synology Account safe and secure? - Synology Knowledge Center[6] What should I do if I cannot sign in to my Synology storage system? - Synology Knowledge Center[7] Hackers and Synology Firewall | Synology Community[8] I see a "Not Secure" warning when connecting to my Synology device via HTTPS. What can I do? - Synology Knowledge Center[9] snyk — command reference[10] do — command reference[11] bun-i — command reference[12] DSM 7.2 User Guide[13] Surveillance Station Web API[14] Release Notes for Synology Secure SignIn | Synology Inc.[15] Synology NAS User's Guide - Based on DSM 7.0 — Document[16] RXD1219sas — Product Manual
Ask the AI about your case ↗

Related fixes

Set up 2FA / Secure SignIn on SynologySynology security hardening checklistSecure remote access to Synology without QuickConnectSynology ransomware recovery — files encryptedSynology firewall rules + GeoIP blockingDisable SMB1 and enable SMB signing on Synology