When Innocence Becomes Currency: Inside the Kido Nursery Cyber-Attack That Shocked Britain

Two teenagers arrested as ransomware attack on London nursery chain exposes vulnerability of early years sector

By [Author Name]
October 8, 2025

This article provides comprehensive coverage of the arrests and investigation into the Kido nursery cyber-attack. For detailed analysis of the initial attack and its impact on families, see When Cybercriminals Target Our Children: The Kido International Ransomware Attack. For insight into why the hackers backed down and what this means for ransomware ethics, read When Criminals Cross the Line: The Kido Nursery Attack and the Limits of Cyber Extortion.

In what cybersecurity experts are calling a "new low" in ransomware crime, two 17-year-old boys have been arrested by Metropolitan Police following a brazen cyber-attack that saw the personal details of approximately 8,000 children stolen from Kido, a premium nursery chain operating across London and internationally. The incident has sent shockwaves through the early years education sector and raised urgent questions about the vulnerability of institutions entrusted with protecting our youngest and most vulnerable citizens.

The Attack: A Timeline of Digital Extortion

The saga began quietly in mid-September 2025 when hackers identifying themselves as "Radiant" infiltrated Kido's digital infrastructure. What followed was not just a data breach, but a calculated campaign of psychological warfare targeting one of society's most trusted institutions.

On September 25, the Metropolitan Police received a referral from Action Fraud following reports of a ransomware attack on the London-based organization. But by then, the hackers had already stolen a trove of highly sensitive information: children's photographs, names, addresses, dates of birth, medical records, safeguarding notes, and detailed contact information for parents and caregivers.

The criminal group claimed to have stolen sensitive data related to around 8,000 children from Kido, which operates in the UK, US, China, and India. To prove their possession of the data and maximize pressure on their target, the hackers began publishing samples on their darknet website.

The group posted the profiles of ten children online on Thursday and another ten on Friday, threatening to release 30 more, along with the personal data of 100 employees. The published data included children's names, dates of birth, birthplaces, and personal details of parents, grandparents, and guardians, including addresses and phone numbers.

In a particularly disturbing escalation, the perpetrators had been contacting parents directly by telephone in order to get the ransom—which is thought to have been around £600,000 ($809,700)—paid. This direct intimidation of families represented a chilling evolution in ransomware tactics, moving beyond institutional pressure to target the emotional vulnerabilities of individual parents.

An Unprecedented Backtrack

What happened next was highly unusual in the world of cybercrime. Following widespread public revulsion over the attacks in the UK, the criminals, who reportedly call themselves "Radiant," appear to have backtracked by removing all the information online and claiming they have deleted all the stolen data. (For detailed analysis of why this retreat matters and what it reveals about criminal pragmatism versus morality, see our related article: When Criminals Cross the Line: The Kido Nursery Attack and the Limits of Cyber Extortion).

The cyber criminals reportedly told BBC News they are 'sorry for hurting kids'. According to reports, the group initially blurred the images of children on their darknet site, concerned about their reputation among other hacking groups, before ultimately removing all the stolen data entirely. It is understood they did not receive any of the ransom money.

While the hackers' apparent remorse may have provided some relief to affected families, cybersecurity experts warn that once data has been exfiltrated, there is no guarantee it has been truly deleted or that copies don't exist elsewhere.

The Arrests: A Swift Response

Following intensive investigation by the Metropolitan Police's Cyber Crime Unit, two 17-year-old boys were arrested at residential addresses in Bishop's Stortford, Hertfordshire, on suspicion of computer misuse and blackmail. The suspects remain in custody for questioning.

Will Lyne, the Met's Head of Economic and Cybercrime, acknowledged the distress caused by the incident: "We understand reports of this nature can cause considerable concern, especially to those parents and carers who may be worried about the impact of such an incident on them and their families. These arrests are a significant step forward in our investigation, but our work continues, alongside our partners, to ensure those responsible are brought to justice."

The swift arrests represent a notable success for law enforcement in tackling cybercrime, though experts note that many ransomware operations involve international networks that can be far more difficult to dismantle.

Why Nurseries? Understanding the Target

The targeting of a nursery chain might seem surprising to some, but cybersecurity experts say it represents a calculated choice by criminals seeking maximum leverage with minimum technical challenge. (For a comprehensive breakdown of the attack timeline and what organizations can learn, see: When Cybercriminals Target Our Children: The Kido International Ransomware Attack).

Unlike typical business data, the compromise of children's information can trigger immediate concern from parents, making them more likely to pressure the nursery into paying ransoms or to respond quickly to threats. This combination of high-value data and potentially urgent parental response makes childcare providers particularly attractive to attackers.

Beyond basic information, nurseries often store photographs, health information and details about children's routines. When personal data is stolen, people immediately suspect identity theft as the primary risk. While this is not the case with children's data, it does come with its own serious risk—knowledge of a child's name, address and routines creates safeguarding concerns.

Anne Cutler, a cybersecurity expert at Keeper Security, emphasized the unique vulnerability: "This case is particularly concerning because it involves one of the most sensitive categories of data—children's personal information. Unlike a credit card, which can be cancelled, a child's name, photograph and home address cannot be replaced."

A Sector Under Siege: The Broader Educational Landscape

The Kido attack is far from an isolated incident. The global education sector has become one of the most frequently targeted by ransomware criminals, with attacks increasing dramatically in recent years.

Ransomware attacks surged 69% in the global education sector for the first quarter of 2025 compared to the same period last year. Some 81 ransomware incidents—both confirmed and unconfirmed—hit education internationally in the first three months of the year, compared to 48 attacks in Q1 of 2024.

Education was the fourth-most-targeted sector during the first half of 2025, behind business, government and healthcare. Some 82% of K-12 schools in the U.S. experienced a cyber incident between July 2023 and December 2024.

The financial impact on institutions can be devastating. Within the education sector, ransoms averaged $608,000 among confirmed attacks, with the largest ransom hackers demanded being $1.5 million from Asia University in Taiwan.

For lower and higher education institutions, recovery costs extend far beyond ransom payments. The mean cost in 2024 for lower education organizations to recover from a ransomware attack was $3.76 million, more than double the $1.59 million reported in 2023. Higher education organizations reported a mean cost of $4.02 million, almost four times higher than the $1.06 million reported in 2023.

The Perfect Storm: Why Schools and Nurseries Are Vulnerable

Several factors converge to make educational institutions particularly susceptible to cyber-attacks:

Limited Resources: The reality is that tight budgets of many educational institutions force them to struggle with outdated equipment and limited staff, making education an easy target for ransomware gangs.

Most places of education use apps for parent convenience but the implementation of these platforms is often not done with security being an inherent consideration, let alone mandatory. The education sector is lean, so usually schools and nurseries are themselves responsible for setting up, running, and maintaining apps, but it's rare that they possess the cybersecurity know-how to do so securely.

Valuable Data Holdings: Educational institutions maintain extensive databases containing not just names and addresses, but medical records, special educational needs information, behavioral notes, family circumstances, and financial data—a comprehensive profile that could be exploited in multiple ways.

Multiple Entry Points: The proliferation of educational technology platforms, learning management systems, parent communication apps, and third-party vendors creates numerous potential vulnerabilities. Supply chain attacks, where criminals compromise a vendor's systems to access multiple clients, have become increasingly common.

Human Factors: In lower education, phishing was the most reported technical root cause, cited in 22% of cases. However, the methods of attack were broadly distributed, with malicious emails, exploited vulnerabilities, and compromised credentials also reported at similar levels.

The Radiant Group: A New Threat Actor Emerges

The attack is the first to be claimed by the new threat group 'Radiant'. According to Palo Alto Networks, there's no information about the group beyond what it has supplied itself. The group doesn't as yet appear to be affiliated with any nation-state actors or other established cybercrime syndicates.

The emergence of new ransomware groups remains a persistent challenge for law enforcement and cybersecurity professionals. While established groups like LockBit, RansomHub, and Medusa operate with known tactics and infrastructure, new actors like Radiant can appear suddenly, strike, and potentially dissolve or rebrand before comprehensive intelligence can be gathered. The group's subsequent retreat and apology represents a rare case study in how even criminal operations must navigate boundaries within their ecosystem—a dynamic explored in depth in When Criminals Cross the Line: The Kido Nursery Attack and the Limits of Cyber Extortion.

Palo Alto researchers said the incident appears to be a ransomware attack combined with data exfiltration, a tactic commonly known as double extortion. This approach has become standard practice in ransomware operations: criminals not only encrypt an organization's data but also steal it, threatening to publish sensitive information even if the victim has backup systems and can restore their files.

The Human Cost: Parents Left in Limbo

For the families affected by the Kido breach, the statistics and technical analysis offer little comfort. One parent, Stephen Gilbert, who has two children at a Kido nursery, told BBC Radio 4's Today programme that families were notified of the breach 10 days ago but "there's been little or no update since then." He added: "I didn't think too much of it until the revelation that the details could have been put on the dark web, which is concerning and alarming to me."

Bryony Wilde, whose child attends a Kido nursery in London, expressed the frustration many parents feel: "They are kids—their personal details shouldn't be worth anything. You are probably prepared to go a little bit further to protect children."

The psychological impact on families extends beyond immediate concerns about data misuse. Parents must now consider whether their children's information could be used for identity theft in future years, whether their home addresses are known to criminals, and whether their family's routines and vulnerabilities have been mapped by malicious actors.

Official Response and Sector Reaction

The incident prompted immediate responses from government agencies and sector organizations.

Jonathon Ellison, NCSC Director for National Resilience, stated: "Cyber criminals will target anyone if they think there is money to be made, and going after those who look after children is a particularly egregious act."

The National Day Nurseries Association called the cyber-attack on Kido 'utterly reprehensible, breaching all reasonable safeguards'. Its executive chair, Purnima Tanuku said, 'Our hearts go out to all the parents and nursery staff who have been affected, this must be extremely worrying for them. Unfortunately because nurseries are obliged to carry a lot of data on the children they care for, they have to be especially vigilant. Most nurseries are small and medium-sized family businesses and aren't all able to invest in sophisticated IT systems. They must be supported to be able to combat attacks like this one.'

Kido itself has maintained communication with families while cooperating with authorities. A spokesperson stated: "We welcome this swift action from the Met Police and recognise this is an important milestone in the process of bringing those responsible to justice. We have cooperated throughout this process with law enforcement and the relevant authorities. We remain committed to supporting police and, importantly, families, colleagues, and the wider Kido community."

Lessons and Recommendations: Protecting the Sector

The Kido incident has crystallized several critical lessons for the early years and broader education sector:

For Individual Settings

The National Cyber Security Centre has published guidance for early years practitioners on how to protect sensitive information about settings and the children in their care from accidental damage and online criminals.

Simple steps can make a big difference, including using strong passwords, backing up data, and being cautious of suspicious emails.

One of the most effective ways for nurseries to strengthen their cybersecurity is to obtain Cyber Essentials certification. Nurseries that rely on digital platforms and systems must carefully evaluate their suppliers, conducting thorough assessments to ensure that every possible measure is in place to protect sensitive data.

Staff Training and Awareness

Human error remains one of the most significant vulnerabilities. Settings must invest in regular training programs that help staff recognize phishing attempts, understand social engineering tactics, and follow proper data handling procedures. This education should be ongoing, not a one-time exercise.

Technical Safeguards

Multi-factor authentication should be mandatory for all systems containing sensitive data. Regular software updates, robust firewall configurations, and network monitoring tools can detect suspicious activity before significant damage occurs. Settings should also implement role-based access controls, ensuring staff can only access the data necessary for their specific responsibilities.

Backup and Recovery Planning

The use of backups to restore data among education providers has dropped to its lowest point in four years. Among those that had data encrypted, only 59% of lower education institutions and 47% of higher education providers restored data using backups. This decline highlights the critical need for consistent, tested backup procedures.

Supply Chain Security

Given that many attacks exploit third-party vendors, early years settings must conduct due diligence on any technology providers they engage with, ensuring these partners maintain robust security standards and certifications. The Kido attack highlighted critical vulnerabilities in the third-party software ecosystem, with early reports suggesting the breach may have occurred through systems used for parent communication and management platforms. Each vendor represents a potential entry point for attackers, making comprehensive vendor security reviews an essential component of any organization's cybersecurity strategy.

Regulatory and Policy Implications

The attack raises questions about whether the current regulatory framework provides adequate protection for children's data in early years settings. While the Information Commissioner's Office (ICO) provides guidance and can investigate breaches, the ICO Security Report recently named the education and childcare sector as the second worst offender for data breaches in the UK—accounting for almost 1 in 7 cases since 2019.

Some experts have called for mandatory cybersecurity standards for early years settings, similar to requirements in other sectors handling sensitive data. Others suggest that government funding specifically for cybersecurity improvements could help level the playing field for smaller settings that struggle to afford proper protection.

There are also questions about whether early years settings should be required to report cyber incidents to a central authority, enabling better tracking of threats and more coordinated responses across the sector.

Looking Forward: A Wake-Up Call

Dr. Emily Chen, a cybersecurity researcher at the University of Oxford, noted: "This is a new low for cybercriminals. Attacking a nursery not only violates privacy but also exploits the emotional bonds of families, creating fear and uncertainty. It's a stark reminder that no organization is immune to these threats, no matter how seemingly benign its mission."

The arrests of two teenagers in connection with the Kido attack may bring some measure of justice, but they cannot undo the harm caused or erase the data that was stolen. As investigations continue, the incident serves as a stark reminder that in our increasingly digital world, even our youngest citizens are not immune to the predations of cybercriminals.

For the early years sector, the message is clear: cybersecurity cannot be an afterthought or a luxury reserved for those with generous budgets. It must be a fundamental consideration in how settings operate, from the software they choose to the training they provide to staff.

As Anne Cutler observed: "By targeting infants and school-aged children, cybercriminals are not only exploiting organisations with fewer defences, but they are also deliberately inflicting emotional harm to strengthen their ransom demands."

Dr. Chen's words resonate with particular force: "As our world becomes more connected, we must prioritize digital safety with the same urgency we apply to physical safety. The stakes are too high to do otherwise."

The children whose data was compromised in this attack will grow up in a world where digital security and physical security are increasingly inseparable. The question facing policymakers, educators, and parents is whether we can build systems robust enough to protect them as they navigate that world—or whether incidents like the Kido attack will become the new normal.

For now, as investigators work to bring those responsible to justice and Kido works to restore trust with its families, one thing is certain: the age of innocence, at least in the digital realm, is over.

Related Reading

For deeper analysis of this incident, see our companion articles:

• When Cybercriminals Target Our Children: The Kido International Ransomware Attack - A detailed examination of the initial attack, the timeline of events, what data was stolen, and critical lessons for organizations handling family data.
• When Criminals Cross the Line: The Kido Nursery Attack and the Limits of Cyber Extortion - An in-depth look at why the hackers retreated, historical precedents of ransomware groups crossing moral boundaries, and what this reveals about criminal pragmatism in the cyber underworld.

If you have been affected by this incident or have concerns about data security at your child's early years setting, the National Cyber Security Centre provides guidance at www.ncsc.gov.uk, and the Information Commissioner's Office can be reached for data protection concerns at ico.org.uk.

This article incorporates information from BBC News, CNN, ITV News, Nursery World, IT Pro, Malwarebytes, K-12 Dive, Sophos, Comparitech, and other sources.