Loading story…
Hackers operating under the name 'Radiant' claimed responsibility for stealing sensitive data from Kido, a nursery chain with operations in the UK, US, China, and India. The attackers posted samples of the stolen data, including pictures and profiles of children, on their darknet website to prove their possession and issued a ransom demand to Kido, threatening to release more data if their demands were not met. The group escalated their threats by adding more children's profiles and publishing private data of dozens of Kido employees, such as names, addresses, National Insurance numbers, and contact details. In a further escalation, the criminals reportedly contacted parents directly with threatening phone calls, increasing the pressure on Kido to pay the ransom. Public backlash and condemnation from the cybersecurity community led the attackers to initially blur the children's images, though the data remained online. Eventually, the hackers removed all the data and issued an apology, claiming to have deleted all the children's data and expressing regret for their actions. Despite these claims, cybersecurity experts cautioned that data, once exposed online, is difficult to fully erase and may resurface in the future. The attackers also revealed that they had paid an initial access broker for entry into Kido’s systems, suggesting a broader criminal ecosystem at play. While the immediate threat to the children’s data appeared to subside, concerns remained about the long-term implications of the breach. In a separate but related incident, a security researcher discovered a data leak involving over 600 resumes and CVs of Kido employees or job applicants, primarily from the Amelio school in India and kidoschools.com. This leak was reported to Kido, who promptly secured the exposed data after being notified. The exposed resumes contained extensive personal information, raising additional privacy concerns for affected individuals. The data leak was found in a publicly accessible storage bucket, which had been listed on Grayhatwarfare, indicating the possibility that others may have accessed the information before it was secured. Kido’s spokesperson confirmed the data had been locked down, but the company was still investigating the extent of unauthorized access. The dual incidents highlight significant weaknesses in Kido’s data security practices and underscore the risks faced by organizations handling sensitive information about children and employees. The breaches prompted discussions about the adequacy of Kido’s incident response and the need for improved security controls. The events also serve as a warning to other educational institutions about the importance of safeguarding personal data and monitoring for potential exposures. The public and regulatory scrutiny following these incidents is likely to drive further changes in Kido’s security posture and notification practices. The situation remains fluid as Kido continues to assess the full impact and potential obligations to notify affected individuals.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Radiant added an unnamed hospital in Minnesota to its leak site and threatened to publicly identify the victim if extortion demands were not met. Reports said the group gave the hospital seven days, with an Oct. 13 deadline mentioned for compliance.
Kido International said it observed Radiant remove the previously published information and that it was following authorities' guidance not to pay a ransom. The company said it was working with law enforcement and cybersecurity experts to investigate and confirm permanent deletion of the stolen data.
Radiant said it removed the Kido data from its leak site, claimed an affiliate had 'gone rogue,' and stated it would not continue leaking the nursery chain's data. The group also said it would stop intrusions against organizations holding children's information and provided a security report and deletion log.
After the Kido leak, the Nova ransomware group publicly criticized Radiant on the Russian-language RAMP forum for exposing children's data. The criticism became a key factor in Radiant's subsequent response.
Radiant targeted Kido International, also known as Kido Schools, and published stolen data including images of preschoolers and parents' contact details. The incident drew significant backlash because it involved children and families.
Radiant Group began operating in September 2025 and appeared with a small number of victims on its leak site. Reporting later described it as a newly emerged ransomware operation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcego.theregister.com
Open sourcemalwarebytes.com
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two 17-year-old boys were arrested in Bishop’s Stortford, Hertfordshire, in connection with a cyberattack and attempted extortion targeting the British nursery school chain Kido. The Metropolitan Police Service led the investigation after receiving a referral about a ransomware attack on September 25. The attackers gained unauthorized access to sensitive data, including pictures and names of children enrolled at Kido’s nursery schools, as well as addresses and contact details for their parents and carers. The perpetrators published images and personal information of 20 children online, out of an estimated 8,000 children affected by the breach. This exposure significantly increased the risk to the children’s safety and wellbeing, prompting widespread concern among parents, carers, and the cybersecurity community. The attackers used the stolen contact information to make threatening phone calls to parents and carers, escalating pressure on Kido to pay an extortion demand in bitcoin. The incident was described by cybersecurity experts as a disturbing evolution in criminal tactics, given the targeting of vulnerable children and the use of their personal data for extortion. The Metropolitan Police’s cybercrime unit worked swiftly to identify and apprehend the suspects, who remain in custody for questioning on suspicion of computer misuse and blackmail. The breach and subsequent extortion attempt have been condemned by both law enforcement and cybersecurity professionals, highlighting the emotional and psychological impact on the affected families. The authorities have reassured the public that they are taking the matter seriously and are providing support to those impacted. The case has raised broader concerns about the security of sensitive data held by educational institutions and the potential for such information to be weaponized by cybercriminals. The incident has also sparked discussions about the need for enhanced cybersecurity measures and awareness in the education sector. Law enforcement officials have emphasized the importance of reporting cyber incidents promptly to facilitate rapid response and investigation. The arrests represent a significant development in the ongoing investigation, but the full extent of the breach and its long-term consequences for the victims are still being assessed. The Kido nursery chain is cooperating with authorities and has taken steps to notify affected families and bolster its cybersecurity defenses. The case serves as a stark reminder of the evolving threat landscape and the need for vigilance in protecting sensitive information, especially when it concerns children.
Jun 29, 2026
VentureEd Solutions fixed a vulnerability in *Ravenna Hub*, a student admissions and application-tracking platform used across thousands of schools, after it was found to expose sensitive information about children and their families. The issue was an **insecure direct object reference (IDOR)** that allowed any authenticated user to access other users’ records by modifying sequential student identifiers in the URL, enabling access to data beyond their own account. Exposed information included children’s **names, dates of birth, home addresses, photos, and school details**, along with parents’ **email addresses and phone numbers** and information about siblings. VentureEd’s CEO said the company was able to reproduce the issue and remediated it after being alerted, but the company did not clearly commit to user notification and did not confirm whether it can determine if improper access occurred; it also declined to provide details on third-party security testing or internal cybersecurity oversight.
Jun 29, 2026
KDDI disclosed that a cyberattack against an email platform it operates for five Japanese internet service providers exposed more than **12.2 million customer email addresses** and **7.6 million passwords**. The compromised system supported customer account management, webmail, and email storage, and the company said the intrusion was enabled by a vulnerability in third-party software used by the platform. KDDI initially reported the unauthorized access in June and later confirmed the scale of the breach after a forensic investigation and notification to Japan’s communications ministry. The company said it patched the flaw and modified the affected system immediately after detecting the attack, adding that investigators found no evidence of compromise beyond exploitation of the vulnerable software. KDDI also said its own consumer email services for mobile and fixed-line internet customers run on separate infrastructure and were not affected. The incident has prompted affected ISPs to coordinate mandatory password resets for impacted users and underscored the risk that a single flaw in shared third-party software can cascade across multiple providers.
Jul 9, 2026