Loading story…
Two 17-year-old boys were arrested in Bishop’s Stortford, Hertfordshire, in connection with a cyberattack and attempted extortion targeting the British nursery school chain Kido. The Metropolitan Police Service led the investigation after receiving a referral about a ransomware attack on September 25. The attackers gained unauthorized access to sensitive data, including pictures and names of children enrolled at Kido’s nursery schools, as well as addresses and contact details for their parents and carers. The perpetrators published images and personal information of 20 children online, out of an estimated 8,000 children affected by the breach. This exposure significantly increased the risk to the children’s safety and wellbeing, prompting widespread concern among parents, carers, and the cybersecurity community. The attackers used the stolen contact information to make threatening phone calls to parents and carers, escalating pressure on Kido to pay an extortion demand in bitcoin. The incident was described by cybersecurity experts as a disturbing evolution in criminal tactics, given the targeting of vulnerable children and the use of their personal data for extortion. The Metropolitan Police’s cybercrime unit worked swiftly to identify and apprehend the suspects, who remain in custody for questioning on suspicion of computer misuse and blackmail. The breach and subsequent extortion attempt have been condemned by both law enforcement and cybersecurity professionals, highlighting the emotional and psychological impact on the affected families. The authorities have reassured the public that they are taking the matter seriously and are providing support to those impacted. The case has raised broader concerns about the security of sensitive data held by educational institutions and the potential for such information to be weaponized by cybercriminals. The incident has also sparked discussions about the need for enhanced cybersecurity measures and awareness in the education sector. Law enforcement officials have emphasized the importance of reporting cyber incidents promptly to facilitate rapid response and investigation. The arrests represent a significant development in the ongoing investigation, but the full extent of the breach and its long-term consequences for the victims are still being assessed. The Kido nursery chain is cooperating with authorities and has taken steps to notify affected families and bolster its cybersecurity defenses. The case serves as a stark reminder of the evolving threat landscape and the need for vigilance in protecting sensitive information, especially when it concerns children.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The UK Metropolitan Police arrested two 17-year-old boys in England in connection with the Kido nursery cyberattack and the online doxing of children. Police said the investigation was ongoing, and officials described the incident as deeply distressing.
On 2025-10-02, the attackers reportedly removed the leaked files from their dark web site after failing to extort Kido. One report says the group later claimed it had deleted the stolen data following backlash.
Kido stated that the compromised children's data had been stored in the Famly software platform used by nurseries to share information and photos with parents. Famly's CEO said Famly's own infrastructure was not breached and that no other customers were affected.
After the breach, the attackers published some children's photos and home address information on a dark web leak site and reportedly made threatening calls to parents. They demanded a £600,000 Bitcoin ransom from Kido as part of the extortion campaign.
On 2025-09-25, the Radiant Group targeted London-based nursery chain Kido in a ransomware attack. Reports say the attackers stole sensitive data relating to children and families, including photos, contact details, and other personal records.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
sentinelone.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourcehackread.com
Open sourcebbc.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hackers operating under the name 'Radiant' claimed responsibility for stealing sensitive data from Kido, a nursery chain with operations in the UK, US, China, and India. The attackers posted samples of the stolen data, including pictures and profiles of children, on their darknet website to prove their possession and issued a ransom demand to Kido, threatening to release more data if their demands were not met. The group escalated their threats by adding more children's profiles and publishing private data of dozens of Kido employees, such as names, addresses, National Insurance numbers, and contact details. In a further escalation, the criminals reportedly contacted parents directly with threatening phone calls, increasing the pressure on Kido to pay the ransom. Public backlash and condemnation from the cybersecurity community led the attackers to initially blur the children's images, though the data remained online. Eventually, the hackers removed all the data and issued an apology, claiming to have deleted all the children's data and expressing regret for their actions. Despite these claims, cybersecurity experts cautioned that data, once exposed online, is difficult to fully erase and may resurface in the future. The attackers also revealed that they had paid an initial access broker for entry into Kido’s systems, suggesting a broader criminal ecosystem at play. While the immediate threat to the children’s data appeared to subside, concerns remained about the long-term implications of the breach. In a separate but related incident, a security researcher discovered a data leak involving over 600 resumes and CVs of Kido employees or job applicants, primarily from the Amelio school in India and kidoschools.com. This leak was reported to Kido, who promptly secured the exposed data after being notified. The exposed resumes contained extensive personal information, raising additional privacy concerns for affected individuals. The data leak was found in a publicly accessible storage bucket, which had been listed on Grayhatwarfare, indicating the possibility that others may have accessed the information before it was secured. Kido’s spokesperson confirmed the data had been locked down, but the company was still investigating the extent of unauthorized access. The dual incidents highlight significant weaknesses in Kido’s data security practices and underscore the risks faced by organizations handling sensitive information about children and employees. The breaches prompted discussions about the adequacy of Kido’s incident response and the need for improved security controls. The events also serve as a warning to other educational institutions about the importance of safeguarding personal data and monitoring for potential exposures. The public and regulatory scrutiny following these incidents is likely to drive further changes in Kido’s security posture and notification practices. The situation remains fluid as Kido continues to assess the full impact and potential obligations to notify affected individuals.
Jun 29, 2026
A 16-year-old boy was arrested in Portadown, County Armagh, on suspicion of offenses under the Computer Misuse Act after a targeted cyberattack disrupted Northern Ireland’s centralized `C2K` school IT network. The Police Service of Northern Ireland said the suspect was later released while its cybercrime team continues investigating. The attack forced the Education Authority to take `C2K` offline to contain the incident, cutting off access to online teaching materials, assignments, exam revision resources, and communication tools used by most schools across the region. The Education Authority, working with service provider Capita and an incident response firm, said the breach affected a small number of schools and is believed to have compromised some personal data. Officials said the incident is currently assessed as contained, with no evidence of data corruption and recovery underway through password resets, added security measures, and phased restoration of services. Reconnection is being prioritized for pupils at critical academic stages, particularly those preparing for examinations, while authorities coordinate the investigation and any required notifications with the PSNI and the Information Commissioner’s Office.
Jun 29, 2026
NHS Dumfries and Galloway disclosed a cyberattack that raised the risk of patient data exposure, and weeks later stolen records linked to the incident were published online as part of an extortion campaign. Reporting indicated that highly sensitive files involving children’s health information were among the leaked material, escalating the impact from service disruption to a serious confidentiality breach affecting vulnerable patients. The incident fits a broader pattern of ransomware and extortion operations targeting healthcare providers, where attackers disrupt clinical systems and use stolen data to pressure victims. Similar attacks previously hit New Zealand’s Waikato District Health Board, where a ransomware intrusion crippled hospital IT, forced lengthy restoration from backups across hundreds of servers and thousands of workstations, and underscored that healthcare organizations remain high-value targets because outages and data theft can directly affect patient care.
Jun 29, 2026