Kido International disclosed a ransomware incident in September 2025 affecting its multinational early-years nursery network. The attackers claimed to have accessed information on approximately 8,000 children and staff, including names, photographs, dates of birth, home addresses and parent contact details. Early reporting indicated that the intrusion began through a third-party platform used to store and share children’s photographs and developmental records with parents. Ten sample child profiles were posted on a dark-web leak site before being removed, while the group threatened further publication through communications with Sky News.
Cybersecurity outlets identified Radiant as the likely perpetrator, describing tactics associated with double-extortion ransomware: stealing data, potentially encrypting systems and using staged leaks and countdowns to pressure the victim. Kido said it notified affected families, hired external cybersecurity specialists and reported the breach to the UK Information Commissioner’s Office. The National Cyber Security Centre issued guidance to early-years providers, citing broader weaknesses from cloud dependence, fragmented infrastructure and limited security capacity. The Metropolitan Police opened a Cyber Crime Unit investigation, and two 17-year-olds were arrested on 7 October 2025 on suspicion of Computer Misuse Act offences and blackmail; the source does not establish convictions or confirm the attackers’ full claims.
