Kido Schools listed on Radiant ransomware leak site

• Ransomware group: Radiant
• Country: United States
• Sector: Education
• Announcement date: October 12, 2025

Radiant claims data access and subsequent deletion for Kido Schools

The threat actor known as Radiant has officially listed Kido Schools on its dedicated leak site. According to the claims made by the group, data belonging to the educational institution was accessed by the attackers. However, the group has also asserted that the stolen information has since been deleted.

This incident highlights the unpredictable nature of modern ransomware operations. In many contemporary cyberattacks, threat actors employ various tactics to exert pressure on victims. While many groups focus on double extortion—where data is both encrypted and stolen to be used for blackmail—the behavior of specific actors can vary significantly based on their internal protocols or disputes between affiliates.

Details of the alleged incident

The Radiant group has provided a specific justification for their actions regarding Kido Schools. The threat actor alleges that one of its partners violated established internal rules by targeting a company involved in childcare services. As a direct consequence of this rule violation, the group states that all data related to Kido Schools International has been deleted.

Furthermore, the group claims that they have provided the institution with a security report and a deletion log to document these actions. This is an unusual development in ransomware dynamics, as the primary goal of such groups is typically extortion rather than the destruction of the assets they have targeted.

Data involved in the claim

The listing provided by the Radiant group does not contain any specific data samples or file content. The available information is limited to a notification regarding the alleged deletion of the data. The listing names no specific data types.

About Kido Schools

Kido Schools is an educational institution that integrates design, technology, and pedagogical advancements to provide high-quality nursery and preschool education services.

Analysis and implications for the sector

The claims made by the Radiant group may indicate that the institution's operational security could have been compromised. Because the actual deletion of data cannot be independently verified, the institution may need to review its internal audit processes to determine the full extent of the breach and ensure that no unauthorized access remains active within their networks.

Such an incident could potentially impact the institution's reputation among parents and employees. In the education sector, maintaining trust is paramount, as these organizations handle sensitive information regarding young children and their families. For a US-based entity like Kido Schools, any potential unauthorized access could trigger obligations under state-level data privacy laws and child protection regulations.

From a defensive standpoint, organizations in the education sector can benefit from several common security practices to mitigate the risk of such incidents:

• Implementing robust access controls: Ensuring that only authorized personnel can access sensitive student and staff data.
• Continuous monitoring: Utilizing logging and monitoring tools to detect unusual patterns that might indicate unauthorized access.
• Regular audits: Conducting internal and external audits to verify the integrity of data and the effectiveness of security controls.
• Incident response planning: Maintaining a clear plan to react quickly to potential breaches to minimize impact.

At this time, information about the Radiant group remains limited in the public domain, making it difficult to ascertain their full operational patterns or long-term objectives.