Cyber security for small businesses: the trouble with hacking

Cyber attacks aren’t only a problem for banks and big tech firms. More than four in ten UK businesses identified a breach or attack in the last year, and criminals deliberately go after smaller organisations where security tends to be weaker. The good news is that a handful of basics, done consistently, stop most attacks: keep software up to date, turn on two-step sign-in, keep tested backups and train your team to spot phishing.

In September 2025, the attack on the Kido nursery chain in London showed just how personal this can get. It’s a hard story to read, but it holds lessons for any business that keeps customer data.

What happened at Kido

In late September 2025, a criminal group calling itself Radiant claimed it had stolen data on around 8,000 children from Kido’s nurseries in London, including names, photos and home addresses. Early reports said the attackers got in through a third-party platform the nurseries used to share photos and updates with parents.

The group published sample profiles of children on a dark web site to pressure the company into paying. After a strong public backlash, it took the profiles down and said it had deleted the data. On 7 October 2025, the Metropolitan Police arrested two 17-year-olds on suspicion of computer misuse and blackmail. Kido informed families and the Information Commissioner’s Office, and the National Cyber Security Centre issued guidance to early years providers.

We’ve written a short update on the investigation.

Why this attack was different

• It targeted children’s data. Information about children can be used for identity fraud and can put families at risk, which makes the pressure on the victim enormous.
• It used extortion in stages. Releasing data a little at a time is designed to keep the pressure on and push the victim towards paying.
• It came through a supplier. The weak point wasn’t necessarily the nursery’s own systems. If a supplier holds your customers’ data, their security is your problem too.
• The damage goes beyond the data. Trust from parents and regulators, time spent dealing with the fallout, and possible legal claims all follow a breach like this.

What the latest UK figures show

The government’s Cyber Security Breaches Survey 2025/2026, published in April 2026, is the best picture we have of what’s happening to UK organisations:

Measure	Businesses
Identified a breach or attack in the last 12 months	43%
Micro businesses (fewer than 10 staff)	42%
Small businesses (10 to 49 staff)	46%
Hit by phishing	38%
Have any form of cyber insurance	47%
Have a formal incident response plan	25%
Reviewed risks from immediate suppliers	15%

The survey estimates that UK businesses experienced around 5.19 million cyber crimes over the year. It also points out that these figures only include attacks that organisations noticed and were willing to report, so the true picture is likely to be worse.

Your website is part of your security

Plenty of small business websites run on WordPress, and WordPress itself is secure when it’s looked after. Problems come from what sits around it:

• plugins and themes that haven’t been updated for months
• old versions of PHP or the database software on the server
• admin accounts with weak or reused passwords and no two-step sign-in
• abandoned test sites and forgotten logins
• cheap hosting with no firewall, monitoring or proper backups

If you can’t say when your website’s software was last updated, that’s the first thing to check.

Ten practical steps to reduce your risk

1. Update everything regularly: your website, plugins, themes, server software, laptops and phones. Turn on automatic updates where you can.
2. Turn on two-step sign-in (multi-factor authentication) for email, your website, banking, accounts software and social media.
3. Use a password manager so every account has a long, unique password.
4. Keep backups that attackers can’t reach. Store copies off-site and offline, and test restoring them at least twice a year.
5. Train your team to spot phishing. Most attacks start with an email or text that looks genuine. Make it easy and blame-free to report anything suspicious.
6. Check your suppliers. Ask anyone who holds your customers’ data how they protect it, how quickly they patch, and how they’d tell you about a breach.
7. Hold less data. If you don’t need it, don’t collect it, and delete what you no longer need. Data you don’t have can’t be stolen.
8. Write a simple incident plan. Who do you call, what do you switch off, how do you tell customers? Remember that personal data breaches must usually be reported to the ICO within 72 hours.
9. Consider Cyber Essentials. The government-backed scheme covers five basic controls that protect against the most common attacks, and certification reassures customers.
10. Look at cyber insurance. It won’t stop an attack, but a good policy brings in specialist help quickly and can cover lost income, legal costs and the cost of recovery. Read what’s covered carefully.

Cyber security is a boardroom issue

The damage from a breach, to your reputation, your finances and your relationships with regulators, is almost always far greater than the cost of preventing one. Customers expect you to take care of their data, and “we didn’t think it would happen to us” won’t reassure anyone.

The question isn’t whether your business can afford to invest in better protection. It’s whether it can afford not to.

Ready for some help?

Not sure how secure your website is? Book a free chat and we’ll take a look. Our sister company, Digital Web World, builds and hosts WordPress websites with firewalls, monitoring, daily backups and regular updates as standard.