Likely one of two things has happened:
1) You've either wittingly (or unwittingly via UPnP) forwarded either HTTPS or SSH to the outside world for remote access, which means the hordes of bot nets and hackers out there combing through residential IP ranges across the world all day and every day have spotted that you're running an SSH/HTTPS server and are now trying to breach it via brute force, or password list type attacks.
2) There's a vulnerability in one of the other services that has allowed an attacker to get access to the the admin login page, either spoofing headers or something like that to get access.
Either way, neither situation is ideal. If you're always accessing the services on your Synology via the same device(s), then I would strongly suggest setting up a VPN to your home setup to minimise your attack surface. Using a VPN means multiple layers of authenticate can be/are required (certificates, preshared keys, user/pass, or even 2FA if you're so inclined) on top of a much smaller and less-common port range needing to be exposed to the outside world.
The other question is: "Do you really need to access that stuff whilst you're away from the house?" If so, secure it with a VPN. If not wait till you get home or use a public service and let someone else do the security for you, then lock down the homestead.
