• Hacker group Radiant is behind the UK nursery data breach and leak.
• They’re threatening to leak more unless paid.

Hackers who stole sensitive information from a UK nursery chain are threatening to publish more data unless they’re paid.

The group, calling itself Radiant, broke into the systems of Kido, which runs nurseries in the UK and abroad. Last week, they uploaded the personal details of 10 children to their site on the dark web. The site includes what they describe as a “data leakage roadmap,” outlining plans to release dozens more child profiles and information on 100 employees if their demands are not met.

A new player testing limits

An industry briefing seen by The Guardian describes Radiant as a new entrant in cybercrime circles, pushing moral boundaries by targeting children’s data.

Their online posts are written in fluent English, though analysts say the phrasing suggests they may not be native speakers. The group’s leak site contains children’s full profiles, including names, birth dates, places of birth, and family contact details such as addresses and phone numbers.

The hackers claim they also hold data on more than 8,000 children and their families, including accident and safeguarding reports and billing information. They say all UK Kido nurseries have been affected.

On the site, Radiant warns Kido that if negotiations fail, they will “ruin their entire company” by releasing information in stages.

Kido responds

Kido confirmed the data breach and said it moved quickly to investigate.

“We recently identified and responded to a cyber incident. We are working with external specialists to investigate and determine what happened in more detail. We swiftly informed both our families and the relevant authorities and continue to liaise closely with them,” a spokesperson said.

The nursery chain is cooperating with the Information Commissioner’s Office, Ofsted, and the Metropolitan Police, who are investigating.

In an email to parents, Kido UK CEO Catherine Stoneman described the investigation as “complex” and potentially lengthy. She said independent IT forensic experts had been brought in and that the data breach stemmed from “two third-party systems used to process certain data.”

Families whose data was confirmed to be affected have been contacted directly, she added.

The role of third-party software

Kido has 18 nurseries across London and more in the US, India, and China. It told parents the data breach happened through Famly, a platform many nurseries use to share photos and updates with families.

Famly’s CEO, Anders Laustsen, said the company had carried out a full investigation and found no evidence that its systems were breached. “We can confirm that there has been no breach of Famly’s security or infrastructure in any way and no other customers have been affected,” he said. “We of course take data security and privacy extremely seriously at Famly.”

Parents caught in the middle

Some parents have already been contacted directly by the criminals. One woman told the BBC she received a threatening call demanding she pressure Kido to pay, or else her child’s data would be released online.

Sean, whose child attends a Kido nursery in south-west London, said parents were worried but had received little direct communication from the nursery. “How have they got details on just certain kids and not everyone – that’s the bit that’s not making loads of sense,” he said.

He viewed the attack as an unfortunate trade-off that comes with using digital tools. He values the ability to get real-time updates on his child’s activities but believes the app provider should be the one explaining how the breach occurred. “One of the things that’s obviously horrifying is that whoever the people are, they are sinking to new depths trying to extort money out of a nursery and holding children to ransom,” he added.

A growing pattern of cyberattacks

Police advise against paying ransoms, warning that it fuels more attacks. Cybercriminal groups are becoming increasingly active, and major UK companies such as Co-op, Marks & Spencer, and Jaguar Land Rover have all recently been hit.

Many of these incidents have been attributed to Scattered Spider, an English-speaking cybercrime group, and often involve ransomware — malicious software that locks victims out of their systems until payment is made.

The BBC also spoke to Radiant over the messaging app Signal. The group said English was not their first language and admitted to hiring people to make threatening phone calls.

“We do it for money, not for anything other than money,” one member said. “I’m aware we are criminals. This isn’t my first time and will not be my last time.” They added they would avoid targeting preschools again because the case had attracted too much attention.

Want to experience the full spectrum of enterprise technology innovation? Join TechEx in Amsterdam, California, and London. Covering AI, Big Data, Cyber Security, IoT, Digital Transformation, Intelligent Automation, Edge Computing, and Data Centres, TechEx brings together global leaders to share real-world use cases and in-depth insights. Click here for more information.

TechHQ is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.