Kido Nursery Chain Cyberattack: Hackers Delete Data After Backlash

A ransomware group calling themselves Radiant targeted Kido International nurseries in London in late September 2025, stealing sensitive data on approximately 8,000 children. The hackers initially demanded a ransom of around £600,000 in Bitcoin, but ultimately removed all stolen data and apologized after facing widespread public condemnation.

The Cyberattack and Data Breach

The cyberattack compromised a significant amount of personal information, including photographs, names, addresses, dates of birth, medical records, and safeguarding information of children attending Kido nurseries [1]. The Metropolitan Police initiated an investigation following a referral from the Action Fraud cyber crime reporting service on September 25, 2025 [2]. Two 17-year-old boys were arrested in Bishop’s Stortford, Hertfordshire, on suspicion of computer misuse and blackmail [2].

Extortion Tactics and Public Response

Radiant attempted to extort Kido by posting images and profiles of some of the children on a darknet site and even directly contacting parents by phone, urging them to pressure the nursery chain to pay the ransom [2]. This aggressive tactic drew significant public outrage and media attention. The National Cyber Security Centre (NCSC) described the incident as “deeply distressing” [4].

The Unprecedented Retreat

In an unusual move, Radiant reversed course following the backlash. They removed all information from their darknet site, claimed to have deleted the stolen data, and issued an apology, stating, “We are sorry for hurting kids” [2] and [4]. It is understood that Kido refused to pay the ransom, meaning the hackers lost money on the attack after paying for initial access to the system [1].

Expert Analysis

Cybersecurity experts have noted that this retreat may be more about pragmatism than morality. Jen Ellis suggested the criminals were “shocked and worried by the attention their hack has caused and they are trying to protect themselves or their brand” [1]. This case highlights the potential for public pressure to influence the actions of cybercriminals, even in the context of ransomware operations.

Ongoing Investigation

The Metropolitan Police continue their investigation, working with partners to bring those responsible to justice. Will Lyne, Met’s Head of Economic and Cybercrime, emphasized the concern this type of incident causes to parents and carers [2].