Synology NAS Ransomware, Plus 2 Tech Stories
A storage box that quietly holds years of work is easy to forget about until it stops being quiet. That is the practical thread running through today’s brief: old software can turn a backup target into a ransomware target, a restaurant platform can become costly infrastructure, and a chatbot’s most personal records can become part of a bankruptcy sale.
Outdated Synology NAS devices are being hit with ransomware
Synology said on October 29 that attackers are exploiting a vulnerability it patched in December 2024 to encrypt data on devices running outdated versions of DiskStation Manager, or DSM. The company’s advice is direct: update vulnerable systems immediately and enable automatic updates.
The critical flaw is CVE-2024-10441. It can let a remote attacker execute code through Synology’s system plugin daemon without first logging in. In plain language, a crafted request can make the NAS run the attacker’s instructions. Synology lists the fixed releases as DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7, and 6.2.4-25556-8, or later releases in those branches.
If you operate one of these devices, check the installed DSM version rather than assuming someone else handled it. Install the fixed release, turn on automatic updates where that fits your change process, and avoid exposing the management interface directly to the public internet when you can. If files are already encrypted or the device behaves strangely, disconnect it from the network and preserve logs before wiping anything. An update can close the door to this attack, but it doesn’t decrypt files or prove an already-compromised system is clean.
There is a second lesson here, and it matters beyond Synology. RAID is not a backup. RAID can keep data available when a drive fails, but ransomware can encrypt every copy the NAS can reach. If the same administrator account can erase the live files and the backups, the separation may exist on a diagram without existing during an attack. Keep at least one current copy isolated from the NAS, then test a restore. A backup that nobody has restored is still partly a theory.
That isolated copy can be an offline drive, a cloud repository with separate credentials and protected retention, or another system the NAS cannot administer. The brand matters less than the failure boundary. Ask one blunt question: if the NAS administrator account is stolen, can that account also delete every recovery copy? If the answer is yes, buying more disks won’t fix the underlying problem. Separating access and testing recovery will.
Backups & recovery
Backups are comforting right up until you need one. Raymond Tec helps small businesses build practical backup and recovery plans — including the decidedly unglamorous part where we make sure the thing can actually be restored.
The FTC says Toast trapped restaurants in unwanted charges
The Federal Trade Commission and seven states sued Toast on October 29, alleging that the restaurant technology company imposed hidden or unauthorized charges, made cancellation difficult, and didn’t deliver promised support. These are allegations in a complaint, not findings by a court, and Toast will have an opportunity to respond.
The details explain why this is more than a billing dispute. According to the complaint, some restaurants were enrolled in add-ons without consent. The government also alleges that Toast’s “Pay-as-you-Go” plan wasn’t as free of monthly hardware and software costs as advertised, that temporarily closed restaurants still had to pay $85 a month for payment processing, and that some customers faced an undisclosed $150 charge for every month left on a contract when they tried to cancel. Toast also sells loans through Toast Capital, which can complicate an exit.
A restaurant doesn’t swap a point-of-sale system as casually as it cancels a streaming service. Menus, payment processing, payroll, inventory, staff routines, hardware, and financing can all be tied together. That dependence is precisely why clear prices and workable cancellation rules matter.
Toast customers don’t need to assume every charge is unlawful, but they do have a sensible homework list: compare signed order forms with current invoices, identify every add-on, save billing exports and cancellation notices, and document support contacts. If the amounts are material, have an accountant or attorney review the contract before stopping payments or pulling systems out. An angry unplugging can create a second operational problem while the first one is still being sorted out.
Technical discovery & auditing
The public page doesn’t tell you much about the machinery behind it. Raymond Tec audits inherited and long-running projects to uncover the plugins, integrations, data, dependencies, and old decisions that determine what the next change will really involve.
Character.AI’s bankruptcy puts private chats on the asset list
A bankruptcy judge has allowed Character.AI to move ahead with a fast auction process, but has not yet approved an asset sale. Reuters reported on October 30 that the company expects to return to court on November 30 to seek approval. Attorneys general from 41 states have objected to parts of the process, including the possible treatment of children’s chat records. The judge said he would likely appoint a privacy ombudsman to address sensitive-data concerns.
The concern is not abstract. A multistate filing led by Pennsylvania says the service may hold conversations about mental health, relationships, family problems, and other deeply personal subjects, including chats involving minors. Bankruptcy can make databases part of what a buyer wants, while privacy promises and applicable law can limit how that information is transferred or used. Which limits apply here is still unresolved.
There is no evidence that a buyer has received those chats, and panic won’t help. Users who have put sensitive material into the service can review export and deletion options now, with the important caveat that an account-deletion button may not instantly remove backups or records retained for legal reasons. The broader rule is simpler: don’t treat an AI companion like a locked diary. For businesses choosing AI vendors, data export, deletion, retention, and vendor-failure terms belong in the buying decision, not in the cleanup after the vendor fails.
Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.
Sources and further reading
- Synology: ransomware attacks on outdated DSM versions
- Synology security advisory SA-24:20
- FTC: lawsuit against Toast
- FTC and states’ complaint against Toast
- Reuters: Character.AI asset-sale process
- Pennsylvania attorney general: Character.AI data objection
Photo by Jakub Zerdzicki on Pexels.
