Your backup box can now be a weapon. And if you’re running Synology or QNAP on your network right now, you need to know what’s happening.
Synology and QNAP Devices Are Being Actively Exploited Right Now
CISA dropped a warning on May 19th. Thread actors are actively exploiting known vulnerabilities in two of the most popular small business NAS devices: Synology Disk Stations and QNAP. These are the boxes you plug into your network to store files and backups. Thousands of service firms and manufacturing shops have them sitting there right now.
Here’s the problem. Synology and QNAP have added a ton of features over the years—which sounds good until you realize that every single feature is another potential vulnerability. The patches that close these specific flaws came out in March and April. If you haven’t patched yours, it’s sitting wide open to a known exploit. That’s not a maybe. That’s happening today.
And the worst part isn’t just that hackers steal your data. They’re using these devices as a Trojan horse. They compromise the NAS, then use it as a launch pad to push ransomware across your entire local network. One unpatched box can take down your whole operation.
This Isn’t Just About Encryption Anymore—It’s Extortion
Recovery costs for small businesses average $40,000 to $50,000 per ransomware incident. That’s the direct cost. But what’s really changed is the playbook. Hackers aren’t just making your data unusable. They’re stealing it first, then using AI to query through everything and find the stuff that will hurt you most—legal documents, sensitive client information, anything embarrassing. Then they blackmail you on top of the ransom demand.
So you’re not just paying to get your systems back online. You’re also paying to keep your worst secrets from going public. That’s the villain here: the combination of operational shutdown and personal exposure. It’s why this matters more than it did five years ago.
The devices themselves aren’t bad—NAS has its place for backup storage. But they’re not meant to be your primary storage, and they’re definitely not meant to sit on your network without a moat around them. You need a good firewall, good email protection, good SaaS protection, and good endpoint protection. Because these devices do so much stuff, it’s almost impossible for Synology and QNAP to keep every single feature patched at all times.
What You Need to Do This Week
If you’re an ACS customer and you have a Synology or QNAP device, tell us about it. We’ll run a scan to find any “shadow NAS” boxes you might have forgotten about, but we can’t catch everything unless you let us know. If we find one, we’ll patch it.
If you’re not sure whether you have one, ask your team. Manufacturing shops and service firms especially—these devices are common in your world. Don’t assume it’s already patched. Don’t assume it’s on the latest firmware. Check it. And if it is a Synology or QNAP, get it updated today, not next week.
Microsoft Co-Pilot Just Got a Lot More Useful—If You Know How to Use It
Microsoft pushed its co-pilot wave to the spring 2026 update on May 19th and 20th. This is a genuine step change from everything that came before it. Until now, co-pilot was a suggestion engine. It would propose something and wait for you to click yes or no. Annoying. Slow. Not worth the hype.
Now it operates more like a junior employee. You can delegate a task and walk away. Co-pilot can draft and actually send follow-up emails based on a thread. It can schedule meetings by reading the context of your email conversation. It can turn a Word document into a formatted summary report. All without you babysitting it through each step.
For service business owners who live in Outlook and Teams, autonomous follow-up drafting and meeting scheduling alone could reclaim serious time. For manufacturers using Word for SOPs, quality reports, or customer-facing documentation, the ability to auto-summarize documents and generate formatted reports removes a task that usually falls on the owner. Let’s say you get reports delivered via email from your software. If the agent can grab that attachment, read through it, and give you a summary—that’s useful.
The catch? This is still rolling out in waves. Not every feature is live yet. And you need to actually set these things up and test them. Don’t assume it’ll work the way you want until you try it.
Key Takeaways
- If you have a Synology or QNAP NAS device, verify it’s patched to the latest firmware today. Known exploits are being actively used right now.
- Tell your ACS team if you have a NAS device on your network. We’ll scan for shadow devices and patch them if needed.
- Remember: NAS devices need a security moat around them. Good firewall, email protection, SaaS protection, and endpoint protection are not optional.
- Test the new Microsoft Co-Pilot autonomous features in Outlook, Teams, and Word. Start with one workflow—like meeting scheduling or email drafting—and see if it actually saves you time.
- Ransomware recovery costs $40,000–$50,000 per incident for small businesses. Prevention is cheaper than recovery.
Questions about anything we covered today? Schedule a free IT consultation and we’ll walk through it with your business in mind.