The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Two 17-year-old males were arrested in Bishop’s Stortford, Hertfordshire, on 7 October 2025 in connection with a reported cyberattack and alleged extortion attempt against Kido, an international nursery chain. Reporting said data relating to approximately 8,000 children may have been accessed, while profiles of 10 children were published by the attackers. The arrests were made on suspicion of computer misuse and blackmail; they are not charges or convictions.
What happened at Kido?
The reported incident involved unauthorized access to Kido-related nursery data, followed by an alleged ransom demand. The attackers used the name Radiant and reportedly threatened to publish more information unless they were paid.
As an Amazon Associate I earn from qualifying purchases.
According to ITPro’s account, the group published profiles of 10 children as part of the pressure campaign. The material was later removed from the group’s darknet site, and Radiant claimed it had deleted the stolen data. Removing files from one site does not prove that every copy, download or private share was destroyed.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesCoverage described the incident as ransomware-related, but the available reporting establishes data theft and publication threats—not that Kido’s systems were encrypted or shut down. “Data-extortion attack” is therefore the more precise description.
#1 Best Overall
Two suspects were arrested in Hertfordshire
The strongest available report says Metropolitan Police investigators arrested two males, both aged 17, in Bishop’s Stortford on 7 October 2025. They were questioned on suspicion of computer misuse and blackmail, according to reporting that attributed the information to police statements.
Some secondary summaries describe the suspects as a 17-year-old and a 22-year-old. That conflicts with ITPro’s account; without a police or court record resolving the discrepancy, the ages should not be stated more definitively than the contemporary report allows. The suspects have not been named, and an arrest does not establish who carried out the attack, membership of Radiant or criminal liability.
Will Lyne, the Metropolitan Police’s head of economic and cybercrime, said specialist investigators had been working to identify those responsible, described the arrests as a significant step and said the investigation continued with partner agencies. No charge, prosecution or conviction is established by the available material.
Free tools Windows power users keep installed
One-click scans. No signup required.
What information was reportedly exposed?
The reported data related to very young children and their families. It allegedly included:
- Children’s names, dates of birth and birthplaces.
- Photographs or profile information for some children.
- Names and contact details for parents, grandparents and guardians.
- Addresses and telephone numbers.
Readers should not search for, copy or share the leaked profiles. Publishing children’s identifying information can create additional safeguarding and privacy risks.
How many people may be affected?
The reported estimate was approximately 8,000 children. That is not necessarily the number of individual people affected: a child’s record could contain details about several adults, and the source does not provide a formal breach notice defining the count.
| Figure or detail | What it means |
|---|---|
| Approximately 8,000 children | Estimated number of children whose information may have been accessed or stolen, according to the report; not a confirmed count of all individuals or records. |
| 10 children’s profiles | Profiles reportedly published publicly as part of the extortion attempt. |
| Two males arrested | Arrested in Hertfordshire on 7 October 2025 and questioned on suspicion of computer misuse and blackmail. |
Who or what was Radiant?
Radiant was the name used by the attackers. ITPro reported that Palo Alto researchers viewed the group as newly established and apparently unaffiliated with known nation-state actors or established cybercrime syndicates. That is an analyst assessment, not a verified identity.
The arrests do not prove that the two suspects were the entire group, that they used the Radiant name or that they alone conducted the intrusion.
Was Famly breached?
ITPro linked the affected billing, staffing and reporting platform to Famly, a software service used in nursery operations. The available reporting does not establish how the attackers got in, whether the compromise occurred in Kido’s environment, at a supplier or through an integration, or whether either company was technically responsible.
There is no confirmed public account of whether credentials were stolen, guessed, phished or reused, whether a software vulnerability was exploited, or whether every record in the 8,000 estimate was exfiltrated.
What affected families should do
These are precautionary steps, not evidence that every family will suffer fraud or identity theft:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Watch for targeted scams. Be cautious with emails, calls and messages that use nursery names, children’s details or urgent payment requests.
- Do not engage with extortionists. Do not pay or use contact details supplied by alleged attackers.
- Keep evidence. Save messages, headers, screenshots, telephone numbers and dates; do not forward leaked child data.
- Verify through trusted channels. Contact Kido using an established website, app or known telephone number rather than a link in an unsolicited message.
- Ask what was involved. Request confirmation of the family information affected and the protective measures being offered.
- Harden important accounts. Change passwords reused elsewhere and enable multifactor authentication, especially for email, banking and payment accounts.
- Report suspected misuse. Contact the relevant UK fraud-reporting service and financial institutions promptly if money or identity details are misused.
What nurseries, schools and suppliers should learn
The incident shows why childcare security depends on both the nursery and the external platforms that process its records. Organizations should review:
- Which systems hold children’s data and how long historical records are retained.
- Which employees, contractors and suppliers have administrative access.
- Whether multifactor authentication is available and enforced.
- Whether passwords are unique, rotated after suspected exposure and protected against reuse.
- Supplier accounts, application integrations and unusual downloads or logins.
- Whether an incident-response plan identifies who will notify parents, staff, vendors and regulators.
- Whether teams can quickly determine which records were viewed or copied.
- Staff training for phishing, social engineering and extortion attempts.
Recommendations attributed to Palo Alto researchers included reviewing controls, rotating passwords—particularly for operational and administrative accounts—and enabling multifactor authentication where available, as reported by ITPro.
Timeline of the reported incident
| Date or stage | Reported development |
|---|---|
| Before 7 October 2025 | Attackers allegedly accessed Kido-related data, demanded money and threatened further publication. |
| During the extortion attempt | Radiant reportedly published 10 children’s profiles. |
| 7 October 2025 | Two males were arrested in Bishop’s Stortford, according to the report published the following day. |
| 8 October 2025 | ITPro reported the arrests and the continuing police investigation. |
| After publication | The attackers reportedly removed material from their site and claimed deletion; permanent erasure cannot be verified. |
What remains unknown
- The initial access method and whether credentials or a vulnerability were involved.
- Whether the data came directly from Kido, Famly or an integration.
- Whether systems were encrypted or disrupted.
- Whether all estimated records were actually taken.
- Whether the arrested individuals were Radiant members or the only participants.
- Whether charges, prosecution or convictions followed the arrests.
Those gaps matter: they prevent a definitive account of responsibility and mean the deletion claim cannot be treated as assurance that families face no continuing risk.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
