Hackers targeting Kido Schools, a nursery chain, initiated an extortion scheme involving the posting of stolen images and personal data of children on the darknet. The criminals began sharing profiles of approximately 8,000 children last Thursday and added more information days later, demanding payment in Bitcoin to cease their activities. Alongside the posts, they allegedly contacted parents with threatening phone calls to pressure them into paying the ransom.
However, following public backlash against their actions, the hackers, known as Radiant, claimed to have removed the content from their website and apologized for their behavior. Initially, they blurred images but later stated that all information had been deleted. Experts have expressed skepticism regarding the hackers’ claims, citing previous instances where criminals maintained or resold stolen data despite promises to delete it. Notably, past investigations, such as the takedown of the LockBit gang by the UK’s National Crime Agency, revealed that data often remained on criminal servers even after ransom payments were made.
Kido Schools has not paid the estimated ransom of around £100,000. Radiant asserts they acquired access to Kido’s systems through a compromised staff computer, purchased from an “initial access broker.” Much of the stolen data was gathered from Kido’s account with Famly, an early education platform. Famly has clarified that it has not suffered any security breaches and rejected Kido’s claims regarding the source of the data compromise.
Kido has acknowledged the cyber incident and is cooperating with external specialists to investigate further, stating they promptly informed affected families and relevant authorities. Despite the hacker group’s claim of deleting the stolen information, concerns remain about the veracity of these assertions.
Source: https://www.bbc.com/news/articles/c8rv83mrlyyo?at_medium=RSS&at_campaign=rss