Dental Backups Under Attack: Lessons From the Synology NAS Ransomware Wave

Your Safety Net Has a Hole in It

Ask most practice owners what they'd do if ransomware hit, and you'll hear the same confident answer: "We'd restore from backup."

It's a good plan. Until the backups get hit too.

Right now, that's not a what-if. Since early October 2026, a ransomware campaign has been encrypting files on Synology network storage devices, the same kind of box many dental offices use to store backups, X-rays and shared files. It's a fresh wake-up call: dental practice ransomware attacks increasingly go after the one thing you're counting on to recover.

What's Happening Right Now

On October 29, 2026, Synology, a leading maker of network-attached storage (NAS) devices, warned customers that attackers are exploiting a security flaw it fixed back in December 2024. The targets are devices that were never updated, especially ones reachable from the internet.

Victims are being hit with C3RB3R ransomware, which locks every file it can reach, adds ".L0CK3D" to the file names and leaves a ransom note in each folder. There's no free decryption tool, and Synology says it can't unlock files once they're encrypted. Its advice is simple: update now and turn on automatic updates, which aren't switched on by default.

For dental offices, this hits close to home. A NAS in the back office is a popular, affordable place to keep practice management backups and imaging. If it's out of date and open to the internet, it isn't your recovery plan. It's an open door.

And dentistry has already felt this. Earlier in 2026, ransomware at Tampa Bay Dental Implants & Periodontics in Florida hit an internal server holding backups of electronic medical records, affecting 6,400 patients.

Why Attackers Go After Backups First

Modern ransomware gangs aren't just encrypting your files and hoping you pay. They're running a business, and they've learned one thing: a practice with working backups doesn't need to pay.

So they hunt for backups before they strike. Their typical playbook looks like this:

1. Get in quietly, often through a stolen password, a phishing email or an unpatched system.

2. Look around to find where your backups live.

3. Encrypt, delete or steal the backups first, so you have nothing to fall back on.

4. Then lock up everything else and send the ransom note.

If your backup server sits on the same network, uses the same admin passwords, and is always connected, it's not a safety net. It's just one more target.

There's a second problem too. Backups are a complete, tidy copy of your patient records. Stealing them gives criminals everything in one place.

The Questions Every Practice Should Be Asking

Be honest about these:

• Is at least one copy of your backups offline or isolated from your main network?

• Can your backups be changed or deleted by someone with a stolen admin password?

• Are your backups encrypted, so stolen copies are useless to criminals?

• When did you last actually test restoring them? Not just check that they ran, but restore real data?

• How long would it take to get your practice running again? Hours, or weeks?

If any answer made you pause, you're not alone. Backups are one of the most overlooked parts of dental cybersecurity, because they quietly "work" until the day they don't.

How to Build Backups That Survive an Attack

The good news is that ransomware-proof backups aren't complicated. They just need to be set up deliberately.

• Follow the 3-2-1 rule. Keep three copies of your data, on two different types of storage, with one copy offsite.

• Make one copy untouchable. Use "immutable" backups, which can't be changed or deleted for a set period, even by an administrator. Or keep a copy fully offline.

• Patch it, hide it, and lock it. Your backup system should never share passwords with your everyday network, and it should require multi-factor authentication. Keep backup devices like a NAS fully updated with automatic updates on, and never reachable directly from the internet.

• Encrypt everything. If backups are stolen, encryption keeps patient data unreadable.

• Test restores regularly. A backup you've never restored is a hope, not a plan. Run a real recovery test at least every quarter.

• Watch your backups. Alerts for failed jobs or sudden mass deletions can warn you that an attack is underway.

Regulators are heading this way too. The proposed update to the HIPAA Security Rule would require organizations to be able to restore critical systems and data within 72 hours. It isn't final yet, but it shows where expectations are going.

The Lesson: Protect the Thing That Protects You

The Synology attacks and Tampa Bay Dental's breach both show that backups are no longer just your recovery plan. They're a prime target. Practices that isolate, lock down and regularly test their backups can recover from ransomware in days. Practices that don't may find themselves with no good options at all.

At PureStack, we design and monitor ransomware-resistant backups for dental practices: isolated, encrypted, immutable and tested, so you can recover quickly when it matters most.

Book a free backup and ransomware readiness check with PureStack and find out if your safety net will actually hold.