Personal details of thousands of children enrolled at the Kido nursery chain have reportedly been stolen in a major cyberattack, with hackers demanding a ransom from the company.

According to the BBC, the cybercriminals obtained names, photographs, and addresses of about 8,000 children from Kido, which operates 18 nurseries in London and has additional branches in the US, India, and China.

The attackers also claimed to have sensitive information about parents and carers, as well as safeguarding notes, and have allegedly contacted some families by phone as part of their extortion campaign.

Kido has not issued a public statement or confirmed the hackers’ claims, but an employee told the BBC that staff had been notified of a data breach.

Police, regulators respond

The Metropolitan police confirmed they received a referral on Thursday, “following reports of a ransomware attack on a London-based organisation.” A spokesperson said inquiries were ongoing through the force’s cybercrime unit, though no arrests have been made.

The UK Information Commissioner’s Office (ICO) said Kido had reported the incident and that officials were “assessing the information provided.”

The breach comes amid a series of high-profile cyber incidents targeting British companies. Earlier this year, the Co-op reported an £80 mln financial hit linked to an attempted hack, while Jaguar Land Rover (JLR) has been forced to halt car assembly after cybercriminals penetrated its IT systems.

The disruption has shut down vital tracking for parts and vehicles, as well as systems linked to sales of its Range Rover, Discovery, and Defender models.