The NAS in the cupboard is answering the whole internet

Somewhere in most small offices there is a little box that everyone relies on and nobody thinks about. A Synology or a QNAP, usually — a network-attached storage device, or NAS, which is really just a small always-on computer whose job is to hold files. The accounts folder lives on it, the shared photos, the backups, the one spreadsheet the whole business runs on. Someone set it up years ago, it worked, and it has been humming away in a cupboard ever since.

In everyone’s head, that box lives “on the office network” — private, local, tucked behind the walls. The trouble is that a NAS is built to be reached remotely. To make that convenient, the setup wizard offers a feature — Synology calls it QuickConnect, QNAP has myQNAPcloud — that quietly makes the box reachable from anywhere, or someone forwards a port on the router so they can get to their files from home. Either way, a device full of the business’s most important files ends up answering the open internet, often still on the admin account it shipped with.

This is the quiet failure: a file server that feels like furniture, sitting in public. And it is not a rare mistake. When Palo Alto Networks’ researchers went counting in 2021, their scanners found roughly a quarter of a million Synology and QNAP boxes reachable from the internet — and that is precisely the list ransomware crews work through. One strain, eCh0raix, has been targeting both makes for years, because a NAS holds the files worth encrypting and the backups worth destroying in the same place.

Why it stays invisible

Nothing changes on your side when a NAS becomes reachable from outside. Files still open, backups still run, the little status light stays green. From your desk the box behaves exactly as it did the day it was reachable only by colleagues. The exposure has no symptom — which is why it can sit there for months.

Meanwhile the box is easy to find from the other side. Search engines like Shodan continuously scan every address on the internet and index what answers, including NAS login pages by make and model. An attacker doesn’t stumble across yours; they search for “every Synology login page in the country” and yours joins the list the moment it’s reachable. From there the two easy wins are a default or weak admin password, and any security update the box hasn’t been given time to install.

Find it yourself

You can see roughly what an outsider sees in about ten minutes. Nothing to install.

1. Note down which NAS you have — the make (Synology, QNAP, or other) and, if you can, the model. It’s usually printed on the front of the box.
2. From a phone on mobile data — not the office Wi-Fi, so you are genuinely “outside” — open a browser and try to reach the box’s remote address. If you set up QuickConnect, that’s https://quickconnect.to/ followed by your QuickConnect ID; for QNAP it’s your myQNAPcloud address. If a login page loads, the wider internet can reach it too.
3. Find your office’s public IP address — search “what is my IP” from the office network — then type internetdb.shodan.io/ followed by that address into your browser (for example internetdb.shodan.io/203.0.113.7). This free Shodan lookup lists the open ports it has already indexed at that address; a NAS answering the world will show up here. (Shodan’s fuller searches need a free login, and its net: range filter a one-off paid membership — the free lookup is plenty for this check.)
4. On the box itself, check who can log in. Sign in as an administrator and open the user list — Control Panel → User & Group on a Synology, Control Panel → Privilege → Users on a QNAP; the wording shifts a little between versions. Look for an enabled account literally called admin, and for whether two-factor authentication is switched on.

No phone to hand? The simplest tell is in the box’s own settings: if QuickConnect or myQNAPcloud is switched on, or your router has a port forwarded to the NAS, then it is reachable from outside and worth the checks above.

What you are hoping to see is nothing — a login page that won’t load from mobile data, no match on Shodan, no account called admin. What you are looking out for is your file server cheerfully presenting a login screen to the whole internet.

The fix

The aim is simple: the box that holds your files should only be reachable from places you trust.

Take it off the open internet. The cleanest fix is to stop the NAS answering the world at all. Turn off QuickConnect (Control Panel → External Access on a Synology) or myQNAPcloud (its own app on a QNAP) if you don’t truly need them, and remove any router port-forwarding rule pointing at the box. When you genuinely need remote access, reach it through a Virtual Private Network (VPN) — so getting to the files requires being on the network first — rather than exposing the NAS’s own login page.

Retire the admin account. Create a new administrator with an ordinary name and a strong, unique password, then disable the built-in admin account outright. Turn on two-factor authentication for anyone who signs in. A default or guessable admin login is an open door wherever the box sits.

Let it patch itself. These devices ship security updates precisely because flaws in them get exploited — QNAP’s June 2026 advisory alone fixed fourteen, including one that let an attacker tamper with the box’s password-reset links. Turn on automatic updates for the operating system (Synology DSM or QNAP QTS) so the box isn’t waiting on someone to remember.

Protect the backups from the box. Because a NAS often holds both the live files and the backups, ransomware that reaches it can take both at once. Keep at least one backup copy that the NAS itself cannot reach and overwrite — an offline drive, or a separate cloud account — so a bad day stays recoverable.

None of this needs a security team. It needs someone to decide, once, that the box in the cupboard is a computer on the internet — and to close the door it’s been holding open.