Cyber Insights: Kido Schools

FAQs on the Kido Schools Ransomware Attack

• 1. What happened in the Kido Schools cyber attack?

  Kido International, a nursery and early-years education provider, suffered a ransomware and data-extortion attack in September 2025. The threat actor known as Radiant claimed to have stolen highly sensitive personal information relating to approximately 8,000 children and their families and threatened to publish the information unless a ransom was paid.

• 2. What data was compromised in the Kido Schools cyber attack?

  The attackers claimed to have accessed sensitive information including children's names, photographs, home addresses and safeguarding records, as well as information relating to parents and carers. Employee information was also reportedly compromised. The nature of the stolen information made the incident particularly serious because of the potential privacy and safeguarding implications for minors.

• 3. Who was responsible for the Kido Schools ransomware attack?

  A cybercriminal group calling itself Radiant claimed responsibility for the attack. The group used stolen information as leverage in an attempt to extort Kido and initially published samples of children's data on its leak site. The incident attracted widespread condemnation because of the deliberate use of children's personal information as an extortion tactic.

• 4. Did the Kido hackers contact parents directly?

  Yes. Reports indicated that some parents were contacted directly by the attackers as part of their attempts to pressure Kido into paying the ransom. This escalation demonstrates how modern extortion attacks can move beyond targeting an organisation itself and directly involve customers, employees or other individuals whose information has been compromised.

• 5. Did the hackers eventually delete the stolen Kido Schools data?

  Radiant subsequently removed the children's information from its leak site and claimed that it had deleted the stolen data following intense public and cybercriminal-community backlash. However, organisations and affected individuals should treat claims of data deletion by cybercriminals cautiously because there is generally no independent way to guarantee that additional copies have not been retained.

• 6. Why are cyber attacks involving children's personal data particularly serious?

  Children's information can include highly sensitive and long-lived personal identifiers, photographs, addresses and safeguarding information. Unlike passwords, much of this information cannot simply be changed following a breach. Organisations handling children's data should therefore treat it as a high-value information asset requiring particularly strong access controls, monitoring, data minimisation and incident-response procedures.

• 7. What cybersecurity lessons can organisations learn from the Kido Schools attack?

  The Kido incident reinforces the need to identify highly sensitive data, enforce least-privilege access, implement strong authentication and maintain visibility over third-party and SaaS access. Organisations should also have well-rehearsed incident response and crisis communication procedures so that technical containment, regulatory obligations and communication with affected individuals can happen quickly and effectively.

• 8. How can schools and childcare providers reduce the risk of ransomware and data-extortion attacks?

  Education and childcare organisations should strengthen identity and access management, use multi-factor authentication, restrict privileged accounts, monitor unusual access and data transfers, maintain secure backups and carefully assess third-party technology providers. Regular cyber incident response and ransomware tabletop exercises can also help leadership teams prepare for difficult decisions involving data theft, ransom demands, regulatory reporting, safeguarding concerns and communications with parents.