UK ransomware gang deletes stolen children’s data after public outcry

In a rare turn of events, a ransomware gang known as Radiant has claimed to have deleted sensitive data stolen from the Kido nursery chain, following widespread public revulsion and criticism from within the cybercrime community over the targeting of children.

The group had stolen pictures and private information on an estimated 8,000 children and their families from Kido’s nurseries across the UK, US, India, and China. They were demanding a ransom of £600,000 (approx. $800,000) in Bitcoin to prevent the data's release.

Apology and 'damage control'

After publishing samples of the children's profiles on a dark web leak site and reportedly making threatening phone calls to parents, the public and expert outcry over the "appalling" attack was swift and intense.

Cybersecurity experts called the hack "a new low" and "testing the boundaries of morality." One London parent whose child was affected described the hackers as "sinking to new depths."

The group also faced pressure from other cybercriminals. Screenshots from an underground forum show a member of a different gang telling Radiant, "reputation important, don't attack child right."

Radiant subsequently removed the stolen profiles and images from its leak site. The group issued an apology, telling a BBC reporter, "We are sorry for hurting kids. All child data is now being deleted. No more remains, and this can comfort parents."

Morality or self-interest?

Cybersecurity analysts are largely skeptical of the hackers' stated remorse, describing the move as "damage control" rather than a moral awakening.

"Deleting the data wasn't an act of kindness; it was damage control," said Rebecca Taylor, a researcher at cybersecurity firm Sophos. “Radiant learned that stealing data belonging to children doesn't just attract attention, it burns credibility. It erodes any legitimacy they claim, particularly as they appear to be a newly formed group."

Kido, which did not pay the ransom, confirmed that the attackers had removed the previously published information and stated it is working closely with law enforcement and cybersecurity experts to ensure the data is "permanently deleted."