backup
8 articles with this tag
Ransomware attacks on Synology DSM: outdated versions targeted through a flaw fixed in December 2024, what to update and check today (SA-24:20)
On October 29, 2026, Synology said it had identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM, with the aim of encrypting data and extorting a ransom. It strongly urges everyone on vulnerable versions to update DSM immediately and recommends turning on automatic updates. It points to Synology-SA-24:20, whose fixed releases are 7.2.2-72806-1 or above for DSM 7.2.2, 7.2.1-69057-6 for 7.2.1, 7.2-64570-4 for 7.2, 7.1.1-42962-7 for 7.1 and 6.2.4-25556-8 for 6.2. The advisory lists three CVEs, and Synology does not say which of them is being exploited. It has not published the number of victims or any attacker name. This site's conclusion: check your DSM version today, update to the fixed release or later, and do not expose the DSM management interface to the internet. Keep a backup that is separate from the NAS and cannot be overwritten from it.
Osaka Metropolitan University ransomware attack (personal data of about 170,000 people leaked from a contractor's cloud storage): what students, alumni, parents and staff should do
Osaka Metropolitan University in Japan says a large-scale failure hit its virtualization platform in the early hours of October 2, 2026, taking down the campus network, OMU Mail, its websites, and its academic, finance, payroll and library systems. At a press conference on October 5 it said it had concluded the cause was a ransomware attack. Classes were cancelled from October 2 to 8, and in-person classes resumed at all campuses on October 9 (fourth notice). In its fifth notice on October 21, the university said the contractor that builds, operates and maintains its core systems had reported that a device at a company it subcontracts to was hit first. In its sixth notice on November 13, the university set out its findings. Signs show that a large amount of data, including data related to the university, leaked from the subcontractor's device and from cloud storage managed by the contractor. Right after that, the university's systems were accessed without authorization using the legitimate accounts (including system administrator accounts) and passwords that the contractor and subcontractor use for the work. The investigation firm also judged both intrusions to be by the same attacker. According to the contractor's additional report of November 12, the leaked information included important management information of the university (including administrator information for its systems) and personal data of about 170,000 students and staff, such as IDs, names, email addresses and dates of birth. Part of it was highly sensitive: about 1,400 people in total, including bank account numbers (about 20 people), health-related information (about 200), passport images (about 200) and passport numbers (about 1,000). Most of this was data from the system migration work done in fiscal 2021, and it had stayed in the cloud storage after the work was finished. The university says it regards keeping the data for so long, in storage used by many people at the contractor and subcontractor, as a serious problem. It says it has not confirmed a leak of personal data from its own information systems, but cannot rule one out because many systems were encrypted. It plans to contact each affected person individually once they are identified. News reports say about 500 servers stopped and much of the backup data was also encrypted. This site's take: check any message claiming to be from the university on the OMU Entrance page, not through links in emails or texts. If bank or passport data may be involved, watch for contacts that ask for PINs or pose as travel or identity-check procedures. Organizations should not leave migrated data with contractors, and should list the accounts their contractors and subcontractors use.
Hospital Cyberattacks in 2026: Care Disruptions and Patient Guidance
In 2026, cyberattacks disrupted care at hospitals in the US, Belgium and Japan. Laid side by side, the hospitals' own statements show one pattern: inpatient and emergency care continued on paper under downtime procedures, while outpatient clinics, chemotherapy, the hospital pharmacy, appointment phones, the patient portal, ambulance intake and imaging stopped — the functions that connect a hospital to the outside. Downtime procedures should be written for those outward-facing functions, not only for the wards. The way in can be equipment nobody counts as a clinical system, such as a VPN appliance used to maintain medical devices. Patients should check official channels, take urgent medication needs to the hospital's designated line, and not answer suspicious calls claiming to be the hospital.
Canvas (Instructure) Data Breach: Course Enrolments and Messages Leaked — What Students, Teachers and Schools Should Do
According to Instructure, the company behind the Canvas learning management system (LMS), unauthorized activity was detected on April 29, 2026, and usernames, email addresses, course names, enrollment information and messages were exfiltrated. The company says the fields involved are not designed to store passwords, dates of birth, health information, Social Security numbers, financial information, grades or disciplinary records. On May 7 the same actor used another vulnerability to alter pages shown after login. The field list looks mundane, but an email address plus which classes someone takes is exactly what a convincing school-themed scam needs, and messages are free text, so anything people typed there may be included. Verify contact only through your school's official channels; school IT should register security contacts, review logs, require MFA for admins and keep course data backed up outside the LMS.
When Your Web Hosting Provider Is Breached: What Customers Should Do
A provider-side compromise cannot be blocked by customer settings, so the defense shifts from prevention to limiting how much you can lose. The 10 September investigation results established the part that matters most: unauthorized access to the sales management system occurred between April 2023 and March 2026, the affected hosting accounts rose from 583 to 951, and some initial passwords were not hashed. This site's view: treat everything on shared hosting as readable, push secrets, credentials and backups outside the provider, and change any initial password you are still using today.
Tsurugi Handa Hospital ransomware (2021) — an unpatched VPN CVE and backups encrypted along with production
The way in, per the expert committee's report, was an internet-facing VPN device left unpatched against a known vulnerability (CVE-2018-13379), reachable with leaked credentials. Short passwords, no account lockout, and users holding admin rights made it easy to spread to other machines in the hospital (lateral movement). Decisively, the primary system and its backup were on the same network and both were encrypted. A backup that isn't isolated and offline can't be relied on for recovery. EMR recovery took about two months. Defend by patching internet-facing VPNs fast, revoking leaked/reused credentials, and keeping isolated, offline, 3-2-1 backups.
What is malware? Types, infection routes, and the basic defenses
Malware (malicious software) is the umbrella term for software built to harm your devices or data. Viruses, worms, trojans, ransomware, spyware, and bots are all types under it. However different they look, the defense is the same three parts: prevent infection (updates, don't open suspicious attachments/macros, MFA), detect (EDR, antivirus), and be able to recover (backups). Getting these shared defenses right matters far more than memorizing the type names.
What is ransomware? How it works, how it gets in, and how to avoid paying
Ransomware is malware that encrypts your files and demands payment to get them back. Modern attacks add double extortion — they steal data first and threaten to leak it, so decryption alone doesn't stop the breach. Main entry routes: phishing, weak/no-MFA VPN/RDP, and unpatched internet-facing flaws. The single most important defense is offline/immutable backups plus restore tests — being able to recover without paying. Also prevent intrusion (MFA, patching) and limit the damage (least privilege, segmentation).