3-2-1 Backup for NAS: The Rule That Beats Ransomware (and How to Actually Set It Up)

When C3RB3R hit a Synology DS2422+ in October 2026, 70 TB vanished behind encryption in minutes. The victims who walked away whole had one thing in common — not luck, not security software, but a 3-2-1 backup. Here's the rule, why NAS owners keep getting it wrong, and how to set it up on your box in under an hour.

The rule (and its extensions)

• 3 copies of the data (1 primary + 2 backups)
• 2 different media/types (NAS + external drive, NAS + cloud…)
• 1 copy off-site (cloud, another location)
• Extension +1: one copy offline/immutable — disconnected or immutable so ransomware with root can't touch it
• Extension +0: zero errors — verify restores, not just backups. An untested backup is a hope, not a backup.

The NAS-specific trap

A USB drive plugged into the NAS 24/7 is not an offline copy — ransomware with root encrypts mounted USB shares too. Same for a "backup" folder on another share of the same NAS, or a second NAS that mounts the first via SMB. The winning patterns:

• Rotated USB drives: two external drives, swap weekly; the offline one is unreachable during an attack
• Cloud sync with versioning: OneDrive/Google Drive/S3 keep prior versions — encrypted files upload as new versions, pre-attack versions remain (a real recovery path used in the 2026 wave)
• Pull, don't push: a PC that pulls from the NAS over scheduled backup (ransomware on the NAS can't push into a machine it can't reach)
• Immutable/object-lock storage for the serious version

Per-vendor, the 1-hour setup

Vendor	Tool	Off-box target
Synology	Hyper Backup (versioned, deduped) + Snapshot Replication	USB (rotate), C2/S3/B2, another Synology
QNAP	Hybrid Backup Sync 3 (3-2-1 wizard built in) + snapshots	USB, cloud (S3/B2/OneDrive), remote NAS
Asustor	Backup Plan / MyArchive	MyArchive USB (becomes offline), cloud
TerraMaster	TerraSync / Duple Backup + TOS Snapshot	USB, remote TNAS, cloud
UGREEN	UGOS Pro backup app	USB, cloud targets
UniFi / fnOS / Zspace / TieNiu	Vendor backup apps or Docker (restic/Kopia)	Any S3/B2 target, external USB

Test it once, quarterly

Restore a folder you care about to a temp location, open the files, check they're intact. Then delete the temp copy. Ten minutes a quarter converts "I have backups" into "I can recover". Every ransomware AMA on r/synology has someone whose backup turned out to be silently broken since 2023.

Pair this with the hardening checklist (so you don't get hit) — this page is your "when it happens anyway" plan. Already locked? Recovery guide.

Is a USB drive always plugged into my NAS a valid 3-2-1 copy?

It satisfies 'second media' but not 'offline'. Ransomware with root encrypts mounted USB drives too. Rotate two drives (one attached, one in a drawer) or add an immutable/versioned cloud target.

Does RAID count as a backup?

No. RAID protects against disk failure, not deletion, encryption, or corruption — ransomware happily encrypts a healthy RAID array. The DS2422+ victim ran SHR-2; all 70 TB encrypted anyway.

What's the cheapest off-site copy?

Versioned cloud sync of your irreplaceable subset (documents/photos, not your movie library) — a few dollars a month for most households. Compress+encrypt locally first if the provider doesn't do zero-knowledge.

How do snapshots differ from backups?

Snapshots are fast, on-box point-in-time copies — great against ransomware and accidental deletion, but they live on the same machine root compromise can reach. Backups (especially off-box/offline) are slower but survive total box loss. You want both.