In this article
In September 2025, a group using the name Radiant claimed it had accessed Kido International nursery data and threatened to publish children’s profiles. Contemporary reporting put the affected population at roughly 8,000 children. The attack drew attention because the extortion pressure reached families directly and involved highly sensitive information about minors. The event is historical; the security and care obligations it illustrates remain current for nurseries, schools, clinics, and any organization holding records about vulnerable people.
What public reporting establishes
Kido used the Famly childcare-management service. Famly said its core platform infrastructure had not been breached; public reporting did not establish a definitive initial-access path. That distinction matters: data can be exposed through compromised customer credentials, permissions, endpoints, or a service flaw, and the public record does not justify treating one explanation as confirmed. Reports described children’s names and photographs, alongside personal and family contact details. Avoid repeating or redistributing leaked records; minimize copies and use established incident-reporting channels.
Extortion aimed at individuals
Reports said the attackers published sample child profiles and contacted some parents, threatening further disclosure to pressure Kido. That tactic shifts part of the coercion to the people whose data is exposed. A response plan should therefore address family communications, safeguarding, support, and escalation with the same care as service restoration, legal duties, and technical containment.
Arrests are not a finding of guilt
In October 2025, police arrested two suspects in connection with the investigation. Reuters reported their ages as 17 and 22; both were arrested on suspicion of computer misuse and blackmail. An arrest records an investigative step, not a conviction or proof of who operated every part of a campaign. The public record does not establish the suspects’ roles in every part of the intrusion, and the appearance of a leak site is not enough to conclude that the attack required little skill.
A claimed deletion cannot undo disclosure
Radiant later blurred some images and claimed it had deleted data. That claim cannot establish that every copy was erased or that recipients did not retain the material. Once sensitive records leave an organization’s control, containment and support must account for possible continued circulation. Families need clear, careful updates that distinguish verified facts from attacker claims.
Why the lesson applies beyond childcare
Organizations that serve children or other vulnerable groups often manage unusually sensitive records with limited security resources. Data sensitivity and potential harm should shape control priorities regardless of organizational size. SaaS providers, customer identity systems, administrator workflows, and local devices all form part of the data-protection boundary. Vendor assurance is useful, but customers still need to know which identities can access their tenant and how those identities are protected.
What an assessment should examine
- SaaS access and vendor oversight. Map the data, integrations, support access, tenant boundaries, and security responsibilities for each platform holding sensitive records.
- Identity and administrator controls. Enforce MFA, least privilege, strong recovery protections, session expiry, and review of privileged-account activity. Verify customer-side controls even when the vendor reports no platform breach.
- Data minimization and retention. Keep only information needed for care and operations, restrict who can export it, and set retention periods that reduce the impact of account compromise.
- Extortion and safeguarding response. Prepare a verified contact process for families, staff, regulators, and law enforcement. Include privacy, safeguarding, communications, and support owners in exercises.
- Security that fits the sector. Make prioritized improvements achievable for schools and care providers, with clear owners, dates, and evidence rather than treating a limited budget as a reason to defer basic protections.
Current actions for organizations holding sensitive records
- Base access and retention decisions on the sensitivity of the records and the harm disclosure could cause, not the organization’s size.
- Review SaaS tenant permissions, connected applications, administrator accounts, and export paths; remove access without a current purpose.
- Prepare direct, compassionate, fact-checked communication for affected people. Separate confirmed exposure from attacker claims and provide a path for questions and support.
- Practice containment that includes credentials, tokens, logs, backups, and copies held by third parties. Do not promise that leaked data has been deleted unless there is verifiable evidence.
- Avoid equating an arrest, a ransom-site post, or an attacker’s deletion claim with a final account of the incident. Preserve uncertainty where the investigation has not made a finding.
The Kido incident remains a practical reminder that the consequences of a data breach depend on whose information is held and how it can be weaponized. Strong identity controls, restrained data collection, and a response built around affected people are current requirements for every organization entrusted with sensitive records.
Sources and further reading
Reuters: UK police arrest two suspects in Kido data theft