The recent hacking of the nursery chain, Kido, has thrust the importance of cybersecurity in childcare settings firmly into the limelight. Whilst cybersecurity should always be a priority for businesses that handle and store private information, the event has raised the question: are businesses truly ready to face what appears to be an alarming spike in targeted cyber attacks?
Here, we’ll break down how cyber attacks can impact your business, explain the regulations you need to follow as a childcare provider, and give you the tools you need to protect yourself from the fallout of a cyber attack.
Kido nursery cyber attacks: what happened?
In September 2025, a hacker group called “Radiant” breached data from the Kido nursery chain, affecting about 8,000 children across its 18 London nurseries. The hackers stole sensitive information, including names, photos, addresses, dates of birth, details about parents/carers, and even safeguarding reports. They accessed the data through the nursery’s software service, Family, a service used by over 1 million nursery “owners, managers, practitioners, and families.” To prove the breach, the hackers published profiles of 10 children on the dark web. They then demanded a ransom, threatening to publish more data, including employee records, if their demands weren’t met.
The investigation into the hacking is still ongoing, and, as of yet, it’s unclear how widespread the attack’s impact could be.
Why are nurseries and schools targeted by cyber criminals?
- Schools and nurseries hold sensitive child, parent, and staff records, making them attractive to criminals
- Limited IT budgets and expertise can leave education systems more vulnerable than larger corporations
- Attacks on learning systems or safeguarding data can cause major disruption, pressuring institutions to pay ransoms
- Stolen identities, bank details, and personal data can be sold on the dark web
- Exploit the sensitivity of child related data to maximise ransom pressure
What are the cybersecurity regulations in nurseries and schools?
Childcare and education settings are often targeted by cyber criminals. To protect students and staff, National Cyber Security Centre (NCSC) regulations must be followed.
Schools and nurseries have to :
- Back up important information
- Use passwords to control access to computers and information
- Protect devices from viruses and malware
- Deal with suspicious messages
Outside of the NCSC’s guidance, nurseries are also expected to follow further government standards:
Department of Education cybersecurity standards
The Department for Education (DfE) requires schools and nurseries to follow strict digital and technology standards to protect their students and staff. These include risk management, regular patching, strong access controls, and secure handling of pupil and staff data, in line with the UK GDPR and the Data Protection Act (2018).
The DfE also stipulates that schools and nurseries must report breaches to the Information Commissioner’s Office (ICO) within 72 hours of an attack. Failure to do so can result in enforcement notices and fines, as well as significant reputational damage to a business.
General standards for IT
Outside of more rigid cybersecurity practices, there are also guidelines in place to ensure schools and colleges meet IT service and digital equipment standards. The standards are designed to help internal teams make more informed decisions about technology, resulting in safer practices across the board.
How to protect your early years education business from cyber attacks
Businesses can protect nurseries and early years education settings from cyber threats by implementing these key tactics:
- Keep software and systems up to date: Outdated technology leaves gaps for attackers
- Employ a data backup plan: This ensures you can recover quickly if files are lost, stolen, or encrypted in a ransomware attack
- Training and awareness: Staff should receive regular data protection and cybersecurity training, helping them spot phishing attempts and avoid risky practices
- Set up an incident response plan: This will prepare your team to act swiftly if a breach occurs, reducing disruption and minimising the impact of an attack. Your incident response plan should include details for emergency IT support services you can contact in the event of an attack
- Device storage and handling: Ensure the secure storage of devices, from encrypted laptops to password protected tablets used in classrooms
Together, these measures strengthen security and ensure compliance with data protection regulations, helping build trust with families while keeping your business running smoothly and safely.
Preparing for future cybersecurity regulations
As important as it is to comply with current standards of IT and cybersecurity, it’s also vital that businesses look to the future.
The Cyber Security and Resilience Bill, set to be introduced to parliament at the end of 2025, is expected to heighten already stringent expectations around data protection and third-party IT security. Whilst the bill will initially only apply to higher education settings, like sixth form colleges and universities, these enhanced standards will likely extend to apply across primary and secondary education in the near future. As a result, it’s crucial that schools take the necessary steps to ensure their processes meet the highest standards of cybersecurity, working with third-party providers that offer specialist IT support for schools.
Why is IT support for early years education important?
Without IT support and cybersecurity in place, cyber attacks can have a widespread impact on your business and your clients. Early years IT support is tailored to the early years education sector, providing nurseries and daycare settings with reliable technical assistance and maintenance, as well as robust cybersecurity measures. It also ensures compliance with data protection laws, helping nurseries protect their communities while maintaining parents’ trust.
IT support for early years education with Cheeky Munkey
At Cheeky Munkey, we specialise in providing dedicated IT support and cybersecurity to businesses across a wide variety of sectors. Our team works closely with early years education providers to improve their daily practices and strengthen their IT security measures, with ongoing maintenance to ensure systems are always up to date and fully protected.
Take a look at our Kindred Nurseries Case Study
We address technical challenges without interrupting your day to day, so that you can focus on delivering quality education. From monitoring for threats to identifying potential disruptions, we work tirelessly to ensure your business is compliant with data protection regulations, ensuring private and personal data remains protected.
Want to make sure your early years business is fully protected against cyber threats? Don’t wait for an attack to happen: get in touch with our team today and we’ll help you to create a safer, more secure environment for your staff and clients.
About The Author
Previous
