In September 2025, reports emerged that the Kido International nursery chain had suffered a serious ransomware attack.
According to The Guardian, criminals claimed to have stolen the names, addresses and pictures of around 8,000 children, along with information about parents, carers and safeguarding notes. Some families were reportedly contacted directly as part of the extortion attempt.
For anyone working in early years, the story was difficult to read. It wasn’t just data that was compromised, but trust – the very foundation of childcare.
What appears to have happened
While investigations are ongoing, the information shared by police and regulators suggests this was a targeted ransomware attack.
A criminal group gained access to Kido’s systems, copied sensitive data and then encrypted files to demand payment for their return.
The attackers then contacted parents to pressure the organisation further.
The Metropolitan Police confirmed they were investigating the case through their cyber crime unit, and the Information Commissioner’s Office (ICO) received a report from Kido. The nursery group has not confirmed whether any ransom was paid or how the attackers gained access.
Why this incident matters for everyone in early years
The Kido attack shows that even experienced and well-resourced providers can be caught out.
It also reminds us that nurseries, preschools and out-of-school clubs hold the same kind of sensitive information as schools and care settings – and that data has value.
If an attacker can reach your systems, they can reach the families you serve. That is why digital safeguarding and traditional safeguarding go hand in hand.
What smaller settings can learn
Backups are your safety net
Back up safeguarding records, registers and communications data to a secure cloud location. Test your recovery process regularly so you know how long it would take to get back online.Tighten access control
Limit access to safeguarding notes, parent communication apps and billing systems. Make sure each member of staff has their own login, and remove old accounts promptly.Use DNS filtering
DNS filtering, such as Heimdal DNS, stops staff and shared devices from visiting harmful or suspicious websites. It helps block ransomware links before they cause damage.Keep systems updated
Ensure that laptops, tablets and office PCs install updates automatically. Many ransomware groups exploit old software vulnerabilities that have already been patched.Build awareness in your team
Encourage staff to pause before opening attachments or entering passwords. Run short, practical refreshers each term, not long one-off sessions. A five-minute reminder can prevent a costly breach.
Responding calmly to an incident
If your setting ever experiences a data breach or ransomware attack:
Inform your Designated Safeguarding Lead immediately
Contact your IT or cyber support partner
Report the incident to the ICO if personal data is involved
Keep families informed with honesty and care
Focus on recovery, not blame
A calm, well-planned response shows accountability and professionalism – the same qualities Ofsted looks for in safeguarding leadership.
Staying prepared
The lesson from Kido isn’t fear, it’s awareness.
If a large organisation with dedicated staff and resources can be targeted, then smaller providers need protection that fits their scale and budget.
At Black Swan Cyber Security Solutions, we help nurseries, preschools and out-of-school clubs strengthen their defences with practical tools like Heimdal DNS, Huntress Managed Detection, and Axcient Backup – alongside plain-English guidance and training.
