UK police arrest two teenagers suspected of the nursery hack and ransom that saw images and the information of 20 toddlers posted to the dark web
In late September, news broke about one of the most amoral cyberattacks you'll ever hear of. A group calling itself Radiant hacked a software provider called Famly and used this to access data from a UK-based nursery chain, Kido, then began posting information and pictures of literal toddlers on a dark web site. It demanded a ransom lest it post more information and pictures of other children.
The BBC now reports that two 17-year-old boys have been arrested in Hertfordshire by police investigating the hack. The police say both were arrested at home on suspicion of computer misuse and blackmail.
"We understand reports of this nature can cause considerable concern, especially to those parents and carers who may be worried about the impact of such an incident on them and their families," says Will Lyne, the Metropolitan Police's Head of Economic and Cybercrime.
"These arrests are a significant step forward in our investigation, but our work continues, alongside our partners, to ensure those responsible are brought to justice."
It is unclear when the hack happened, but the group first began contacting media in late September. Then on 25 September it posted images of some children and personal information about them on a darknet site, apparently in an attempt to increase pressure on the nursery chain to pay a reported £600,000 Bitcoin ransom. It followed this up by directly contacting some parents, and telling them to put pressure on Kido to pay the money.
In total 20 childrens' pictures and information were posted online. However as the hack attracted public attention the reaction was one of universal disgust, "a truly barbaric new low" as the boss of Famly put it, and the hackers were clearly taken aback. First the group blurred the images they'd posted, before on 2 October removing all the data from their darknet site and claiming they'd deleted all 8,000 childrens' files.
"This is more about pragmatism than morality," said cybersecurity expert Jen Ellis. "These criminals are clearly shocked and worried by the attention their hack has caused and they are trying to protect themselves or their brand."
"We welcome this swift action from the Met Police and recognise this is an important milestone in the process of bringing those responsible to justice," a Kido spokesperson said. "We have cooperated throughout this process with law enforcement and the relevant authorities. We remain committed to supporting police and, importantly, families, colleagues, and the wider Kido community."
The pair remain in custody for questioning, and are yet to be charged.