Teen and Man Arrested Over Nursery Cyber Attack Exposing 8,000 Children

Published: 08 October 2025. The English Chronicle Online.

A 17-year-old teenager and a 22-year-old man have been arrested in connection with a high-profile cyber attack that compromised sensitive information belonging to approximately 8,000 children at the London-based nursery chain, Kido. The Metropolitan Police confirmed that the suspects were detained in Bishop’s Stortford, Hertfordshire, on suspicion of computer misuse and blackmail. Both remain in custody as investigations continue, with authorities working to determine the full extent of the breach and whether others were involved.

The cyber attack, which targeted Kido’s 18 nurseries across London and the surrounding areas, involved the theft of highly sensitive personal information. The stolen data included the names, addresses, and photographs of children attending the nurseries, alongside contact information for their parents. The breach, which was first publicly revealed last week, sent shockwaves through parents and staff, raising urgent questions about cybersecurity practices in childcare and education institutions.

The group behind the attack, a cybercriminal gang known as Radiant, initially posted the stolen data on the dark web, issuing an explicit ransom demand to Kido in bitcoin. The hackers warned that unless their demands were met, the information would continue to be exposed publicly. The attempted extortion triggered an immediate backlash, with concerned parents, cybersecurity experts, and the general public condemning the exploitation of vulnerable children for financial gain.

Following intense scrutiny and public outcry, Radiant deleted all stolen data and issued an apology. “All child data is now being deleted. No more remains, and this can comfort parents,” a member of the group told the BBC. In a further statement, the hackers said, “We are sorry for hurting kids,” acknowledging the distress caused to families and nursery staff. The nursery chain reportedly refused to pay the ransom, estimated at around £100,000, following advice from law enforcement, which consistently warns against yielding to cybercriminals as this can further fuel criminal activity.

Experts have highlighted that cyber attacks targeting educational settings are increasingly common and can have devastating consequences, both emotionally and financially. Elliott Lewis, chief information security officer at ParentPay Group, warned that the Kido incident reflects wider systemic vulnerabilities within schools and nurseries. “Cyber attacks on schools and nurseries remain alarmingly common, with ransomware incidents still occurring weekly. Frustratingly, the causes haven’t changed – phishing, poor patching, and insecure personal devices are still the main culprits,” he said.

Lewis further emphasised the psychological and emotional toll of breaches involving children. “When images and sensitive information about children are compromised, the emotional impact on families and staff is profound. It’s a stark reminder of how educational settings are being targeted not just because of their data, but because of their vulnerability. These are environments where cybersecurity awareness has often lagged behind other sectors, and the consequences of attacks are far more sensitive.”

Kido operates nurseries across several London boroughs, including Waterloo, Clerkenwell, Chiswick, and Fulham. The nurseries are among the most expensive in the capital, with full-time fees reaching up to £2,472 per month, surpassing average private school tuition. The high fees, coupled with the collection of detailed personal data for administrative purposes, make these institutions both attractive and vulnerable targets for cybercriminals seeking financial gain.

The attack has also raised questions about how childcare providers handle sensitive data and whether current cybersecurity measures are sufficient to protect children in private educational settings. Experts argue that institutions handling such data must implement robust systems, including regular software updates, secure storage practices, multi-factor authentication, and employee training on phishing and other cyber threats. The Kido breach serves as a wake-up call for childcare institutions to reassess and strengthen their digital security infrastructure.

This incident is part of a growing trend of cyber attacks in the UK and internationally, which have increasingly targeted high-profile businesses and sensitive institutions. Recent examples include a ransomware attack on Jaguar Land Rover, which resulted in a temporary halt in vehicle production, and a major data breach at Marks & Spencer, which reportedly cost the retailer around £300 million. Analysts warn that cybercrime is evolving rapidly, with hackers employing increasingly sophisticated methods, often exploiting human error or outdated technology to gain access to sensitive information.

Parents affected by the Kido breach have expressed anger and concern over the potential misuse of their children’s personal data. Many families have questioned whether the nursery chain could have done more to prevent the attack and called for greater accountability from private educational providers. Cybersecurity experts note that while no system can be completely immune from attack, proactive measures, including regular audits, secure cloud storage, and rapid incident response plans, can significantly reduce the risks and mitigate harm when breaches occur.

In response to the incident, the Metropolitan Police launched an immediate investigation, prioritising the identification and arrest of the perpetrators. The two arrests in Hertfordshire mark a significant development in the case, but authorities caution that investigations are ongoing and further suspects could be identified. Law enforcement agencies also continue to work with cybersecurity experts to ensure that any remaining data is fully secured and that victims are provided with guidance on protecting their personal information from misuse.

The Kido cyber attack has renewed discussions about the importance of cyber resilience in educational institutions, particularly those handling vulnerable populations. While government guidance and regulations exist for data protection, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, incidents like this highlight gaps in implementation, training, and resources at the institutional level. Cybersecurity specialists stress that organizations must treat digital safety with the same seriousness as physical security to prevent future incidents.

As parents, educators, and authorities grapple with the implications of this breach, the broader issue of cybercrime remains a pressing concern. The rise of ransomware, phishing, and other cyber threats demonstrates the need for a coordinated approach involving law enforcement, technology providers, and organizations that hold sensitive data. Experts have emphasised that education, vigilance, and investment in cybersecurity infrastructure are essential to protecting both personal information and institutional integrity.

For Kido, the incident has caused significant reputational damage, with families voicing concern over the safety of their children’s data and the potential consequences of its misuse. The nursery chain has pledged to strengthen its cybersecurity measures, conduct thorough audits, and work closely with authorities to prevent similar incidents from occurring in the future. Meanwhile, the arrests mark a step forward in holding perpetrators accountable and serve as a warning to others who may attempt to exploit vulnerable institutions.

Ultimately, the Kido breach underscores the growing risks of cybercrime in sectors that handle sensitive information, particularly where children are involved. As digital systems become more integral to educational administration, the importance of robust, proactive cybersecurity measures cannot be overstated. The incident serves as a stark reminder of the responsibilities organizations have to protect the personal data entrusted to them and the consequences of failing to do so.