On 7 October 2025, the Metropolitan Police arrested two 17-year-olds on suspicion of computer misuse and blackmail, following the cyber attack on the Kido nursery chain in London. The attack, which came to light in late September 2025, involved stolen data on around 8,000 children. This post summarises what was reported at the time.
At a glance
- In September 2025, a criminal group calling itself Radiant claimed it had stolen names, photos and addresses of around 8,000 children from Kido’s London nurseries.
- The group published sample profiles to pressure Kido into paying, then took them down and said it had deleted the data after a public backlash.
- The Metropolitan Police arrested two 17-year-olds on 7 October 2025 on suspicion of Computer Misuse Act offences and blackmail.
- Kido informed families and the Information Commissioner’s Office, and the National Cyber Security Centre issued guidance to early years providers.
In this article
What happened
The breach was first reported on 25 September 2025. The attackers said they had taken information about children at Kido’s nurseries, including names, photographs, dates of birth and home addresses, along with parents’ contact details. Early reports said they got in through a third-party platform the nurseries used to share photos and updates with families.
To pressure the company, the group posted sample profiles of ten children on a dark web leak site and threatened to release more. Kido notified affected families and brought in external cyber security specialists.
The attack was widely condemned. According to the BBC, the group had a change of heart after the backlash: it blurred the photos, then removed the profiles and said it had deleted the stolen data. There’s no way to confirm that a criminal group has really deleted anything, which is one reason the authorities advise against relying on promises like this.
The arrests
Action Fraud referred the attack to the Metropolitan Police on 25 September 2025. On 7 October, officers arrested two 17-year-olds in Bishop’s Stortford, Hertfordshire, on suspicion of computer misuse and blackmail.
Will Lyne, the Met’s head of economic and cybercrime, called the arrests “a significant step forward” and said the investigation was continuing. For the latest position, check the Metropolitan Police’s news updates. We haven’t named anyone involved and won’t speculate about the case.
Why it matters to other businesses
This attack wasn’t sophisticated by the standards of large criminal groups, and it didn’t need to be. It worked because the data was valuable, the pressure was personal and a supplier’s system was a way in. The same ingredients exist in many small businesses: customer records, a handful of online systems run by other companies, and little time to check how secure they are.
The government’s Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses identified a breach or attack in the previous year, but only 15% reviewed the cyber risks from their immediate suppliers.
Our article on the trouble with hacking sets out ten practical steps any small business can take, from two-step sign-in to tested backups.
Was the Kido data published?
Sample profiles of ten children were posted on a dark web leak site before the group removed them. The group said it had deleted the rest of the data, but that can’t be independently confirmed.
Who investigated the attack?
The Metropolitan Police’s Cyber Crime Unit, after a report through Action Fraud. The Information Commissioner’s Office was also notified, as personal data was involved.
What should a business do if its data is stolen?
Contact your IT provider or insurer’s incident line, report the crime to Action Fraud and, if personal data is involved, usually report it to the ICO within 72 hours. Don’t negotiate with the attackers without specialist advice.
Need a hand?
If this has made you think about your own website or systems, get in touch. Our sister company, Digital Web World, provides secure WordPress hosting with firewalls, monitoring and daily backups.
References
- The Record, Teenagers arrested in England over cyberattack on nursery chain Kido, October 2025.
- Infosecurity Magazine, Met Police arrest two teens in connection with Kido attack, October 2025.
- AOL (PA Media), Nursery hackers delete children’s data following backlash, UK media reports, October 2025.
- Wikipedia, Kido International cyberattack.
- GOV.UK, Cyber security breaches survey 2025/2026, 30 April 2026.