In September 2025, the childcare sector faced one of its most serious cyber incidents when hackers targeted Kido, a nursery group operating across the UK, US, India and China. The breach exposed sensitive information relating to around 8,000 children, shaking the early years community and forcing everyone to take a closer look at how securely children’s data is handled.
If you manage or own a nursery, here’s what you need to know and what you can do to avoid becoming the next headline.
What happened in the Kido breach
A ransomware group calling itself Radiant claimed responsibility for the attack after gaining unauthorised access to systems used by Kido. The criminals stole highly sensitive data including children’s names, addresses, photographs, dates of birth, parental contact details and confidential medical or safeguarding information.
They demanded a ransom of about £600,000 in Bitcoin. When Kido did not pay, the group escalated by publishing sample data on the dark web and even calling parents directly to apply pressure.
Following public outrage and police involvement, the hackers claimed to have deleted the data and apologised. Two teenagers were later arrested in connection with the attack. However, as security experts warn, once data has been exposed, it may continue to circulate on criminal forums indefinitely.
At the time of writing, the Metropolitan Police investigation is ongoing and new details may emerge as evidence comes to light.
Why this breach matters for your nursery
The Kido incident revealed some uncomfortable truths for the childcare sector:
Nurseries are valuable targets. Personal and medical details about children carry emotional leverage, making them lucrative for criminals.
Third-party software can be a weak link. Systems such as Famly, Tapestry and Blossom are essential tools but also introduce risk if not properly secured.
Many nurseries aren’t ready. Limited budgets and a lack of IT expertise often mean no MFA, no regular security testing and no incident response plan.
The fallout is serious. Beyond distress to families, breaches can lead to fines, reputational harm and potential legal claims.
How the attack happened
At the time of writing, no official forensic report has been released confirming exactly how access was gained. Famly, the platform involved, has publicly stated that its infrastructure was not breached, and that the data exposure occurred within a customer account rather than through a system-wide compromise.
Cyber security experts believe the most likely cause was stolen or compromised login credentials. This is a common entry route for ransomware groups, who often use:
Credentials reused from other breaches
Phishing attacks against staff
Passwords purchased on criminal forums
Weak passwords with no multi-factor authentication
Without MFA, stolen credentials alone can provide full access to systems holding sensitive data. Weak password practices, lack of supplier oversight and limited staff awareness can all contribute to incidents like this.
Five actions every nursery should take
1. Turn on multi-factor authentication (MFA)
Adding a second verification step stops most account takeovers.
Do it now: enable MFA on all nursery systems and staff email accounts, ideally using an authenticator app rather than text messages.
2. Assess your suppliers
If your software stores children’s data, you’re still responsible.
Check: certifications such as ISO 27001, SOC 2 or Cyber Essentials, whether data is encrypted, and how quickly suppliers will notify you of a breach.
3. Improve passwords and awareness
Phishing is still the top way criminals get in.
Set policies: use the NCSC’s three random words method, store passwords in a password manager, and run short, regular staff training sessions.
4. Limit what you keep
Only store what’s essential and only for as long as needed.
Review: retention schedules, old photos and staff access levels. Fewer records mean less risk.
5. Plan for the worst
A clear plan limits panic and reduces harm.
Include: who’s in charge, who to tell (ICO, parents, local authority, insurer), supplier contacts and a tested response checklist.
Your Legal Duties
Under the Data Protection Act 2018 and UK GDPR, nurseries must:
Report qualifying breaches to the ICO within 72 hours
Notify affected families if there’s a high risk to their rights
Give extra protection to children’s data
Accept accountability even if a supplier system is breached
Fines can reach £17.5 million or 4% of turnover, whichever is higher.
What parents will ask
After Kido, parents are understandably more alert. Be ready for questions such as:
“How secure are you?” Explain what controls you have in place: MFA, encryption, staff training, supplier vetting.
“Who can see my child’s data?” Outline access limits and photo-sharing policies.
“What if you were hacked?” Describe your response plan.
“Can I see what you hold?” Have a simple process for subject access requests.
Helpful resources
NCSC: Free guidance for early years settings at ncsc.gov.uk
ICO: Templates and guidance on breach reporting and GDPR compliance
Cyber Essentials: Government-backed certification proving good security practice
Action Fraud: Report cybercrime or ransomware incidents
Moving forward
The Kido breach was a wake-up call. It showed how exposed the sector has become but also how quickly it can unite to protect children’s data more effectively.
You don’t need a huge IT team or big budget to raise your defences. A few smart steps such as MFA, staff awareness, supplier checks and regular reviews can make a real difference.
Parents trust you with their children’s safety every day. Protecting their data is part of that same duty of care.
About Black Swan Cyber Security Solutions
Black Swan helps nurseries, preschools and early years providers across the UK protect sensitive data, meet GDPR and DfE security standards and achieve Cyber Essentials certification. We focus on practical, affordable solutions that strengthen everyday systems, including multi-factor authentication, patch management, staff awareness training and secure cloud backup.
Need help securing your nursery?
Book a free consultation to learn how we can support your setting.
Cyber Security FAQs for Nurseries & Early Years Settings
Yes. In recent years, several early years providers have been hit by cyber attacks, including one large nursery chain whose data breach exposed information about thousands of children. Criminals target nurseries because they hold valuable personal data – names, addresses, photos, medical and safeguarding notes – yet often lack enterprise-level protection.
If personal information about children, parents or staff is accessed or leaked, it becomes a data breach under GDPR. The nursery must assess the risk, inform the Information Commissioner’s Office (ICO) within 72 hours if necessary, and communicate with affected families. There may also be financial and reputational consequences.
Start with strong passwords, multi-factor authentication (MFA), automatic software updates, and secure cloud backups. Limit access to sensitive data, and never use personal email accounts or USB drives for work information. Regular security awareness training helps staff recognise threats before they cause harm.
It’s strongly recommended. Cyber insurance can help cover recovery costs after an attack – from forensic investigation to data recovery and communication with families. However, insurers now expect nurseries to show good security practices such as MFA, endpoint protection, staff training and immutable backups.
Disconnect affected devices, contact your IT or cyber provider immediately, and follow your incident response plan. Report the breach to the ICO if personal data has been compromised and notify families transparently. Avoid paying ransoms – focus on recovery from clean backups.
Specialist providers like Black Swan Cyber Security Solutions work with nurseries and early years settings across the UK to strengthen cyber resilience, achieve compliance, and protect safeguarding data. We tailor solutions around your needs and budget.
