System.Random is not as "cryptographically strong" source of randomness. The output of the Random function is entirely predictable assuming the attacker knows (or can guess) the "seed" value that was used to create the System.Random. If you simply call new System.Random() that initial value is simply a representation of the current system time (something that an attacker can often guess very easily).

Even if the initial time is not exactly known, an attacker can check all of the potential values in a given time range by brute force.

The random generators in the System.Security.Cryptography namespace are designed for use in this kind of situation and gain their unpredictability from a number of much more secure sources.

Please make sure to use a cryptographivally secure random number generator.
From the System.Random docs:
To generate a cryptographically secure random number, such as one that's suitable for creating a random password, use the RNGCryptoServiceProvider class or derive a class from System.Security.Cryptography.RandomNumberGenerator.