Kido, a UK-based nursery business, fell victim to a targeted cyber attack by a hacking group known as Radiant. The attackers gained access to Kido’s systems after an initial access broker sold their network credentials, a common tactic in cybercrime. The hackers subsequently stole and published children’s personal data online, including sensitive profiles, sparking public outrage. While the group later deleted the stolen data following backlash, the breach exposed severe vulnerabilities in the education sector’s cybersecurity defenses. The incident underscored the growing threat to organizations handling minors’ data, where even opportunistic attacks can lead to reputational damage, legal risks, and emotional distress for affected families. The attack also highlighted broader systemic issues, such as underfunded security measures in educational institutions, which are increasingly targeted due to weak defenses and high-value data. Government responses, including potential bans on ransomware payments, aim to mitigate future risks, but the sector remains a prime target for cybercriminals exploiting gaps in protection.

The nursery chain Kido International suffered a ransomware attack by the hacker group Radiant, which stole and leaked personal data of over 8,000 children and employees. The compromised children’s data includes names, addresses, medical records, incident reports, and medication details, while the exposed employee data covers full names, National Insurance numbers, DOBs, home addresses, employment dates, and email addresses. The attackers demanded 1.5% of the company’s annual revenue as ransom, threatening to release more data—including profiles of 30 additional children and 100 employees—if unpaid. The Metropolitan Police and ICO are investigating, but the hackers have already published some data on the dark web. Experts warn that paying the ransom would not guarantee data suppression, as stolen information is often sold to other criminals for fraud or scams. The attack has severely compromised sensitive personal and health-related data of minors and staff, posing long-term risks of identity theft, fraud, and reputational damage to the company.

Kido International, a preschool and daycare organization operating in the UK, US, and India, fell victim to a targeted ransomware attack in September 2023. The Radiant Group, a newly emerged cybercriminal syndicate, breached the company’s systems and exfiltrated sensitive data, including profiles of at least 10 children—comprising photos, full names, home addresses, and parental contact details (including workplaces). The attackers publicly leaked this data on their dark web site as part of an aggressive extortion campaign, threatening to expose more information unless a ransom was paid. While the gang later removed the leaked data under apparent pressure from other criminal actors, some parents reported receiving threatening calls, exacerbating distress. The incident triggered a police investigation, leading to the arrest of two 17-year-old suspects in Hertfordshire on charges of computer misuse and blackmail. The attack not only compromised highly personal and sensitive child and family data but also inflicted reputational harm and psychological trauma on affected families, with potential long-term trust erosion in the institution.