You say it was "behind your router" but I think you've specifically opened ports to your NAS (or you have some sort of NAT and the NAS has done it)
Restrict access (if you must open it to the internet, open to only specific IP addresses) or better yet disable it, and use an ssh port-forward if you really have to get to it.
I don't have any Synology products, but I have a few things on my home network that I like having access to remotely, and my solution has been to put a Raspberry Pi running dyndns and OpenVPN between my home network and the open internet. This way I only need to make sure the Pi is up to date and that OpenVPN is configured and hardened properly, and my potential attack surface area doesn't change no matter how many things I add to my network that I want to access remotely.
So you advocate to buy a NAS and then disconnect it from the Internet, for security reasons? Might just as well turn it off completely, if your use case is similar to mine.
Is it really to much to ask to use the Internet as it was intended? We should consider these products broken.
Was it directly connected to the internet? Do you know how they got access? I am now worrying about my synology, but I am away from home for the next few days.
It was behind my router. My quick scan on log from 2011 shows i had no such problem, until recent months when they started to attack on Synology and turning them into Bitcoin miner.
(Edit) Or it might've been checking for updates, got redirected elsewhere via a DNS hijack, downloaded something funny, didn't bother to check if it's authentic and installed it.
you would still need to have ports forwarded to the NAS from the internet, a compromised router, or the NAS connected directly to the open internet. All of which are a bad idea.
If the device is vulnerable to a CSRF, then couldn't it be compromised simply by some browser on the LAN ending up on an unfortunate site that does some javascript hijinks to POST to likely, internal, IP addresses for a NAS? No open WAN ports needed.
Also, wasn't there a remote root exploit for samba4 patched just days ago?
However, there's really no reason to expose samba shares to the Internet. There are much better and more secure methods. As to the unfortunate victim, there's most likely no way anyone will be able to retrieve what has been locked by the remote attacker - except the remote attacker.
My syslog shows a few people have accessed my NAS this month.
This is worrying.