London’s Metropolitan Police force has arrested two 17-year-old boys in connection with the recent cyber attack at London-based childcare chain Kido, which saw hackers publish photos of toddlers stolen from the victim’s systems to try to extort the firm, causing widespread public anger.
The arrests were made on Tuesday 7 October in Bishop’s Stortford in Hertfordshire, following. The individuals, who cannot be identified due to their age, are suspected of computer misuse and blackmail offences.
“Since these attacks took place, specialist Met investigators have been working at pace to identify those responsible,” said Will Lyne, head of economic and cyber crime at the Metropolitan Police.
“We understand reports of this nature can cause considerable concern, especially to those parents and carers who may be worried about the impact of such an incident on them and their families.
“We want to reassure the community, and anyone affected that this matter continues to be taken extremely seriously,” said Lyne. “These arrests are a significant step forward in our investigation, but our work continues, alongside our partners, to ensure those responsible are brought to justice.”
“These arrests are the latest in a series of law enforcement action against cyber criminals in the UK in response to an escalating number of high-profile incidents,” said Sophos Counter Threat Unit researcher and threat intel knowledge manager Rebecca Taylor.
“Historically, most cyber attacks against businesses have been from Russian groups beyond the arm of the law, but these arrests show that law enforcement can and will take action against individuals within their jurisdiction,” she said.
Leaked photos
The ransomware attack on Kido unfolded in September and saw the personal data of about 8,000 children, as well as contact details of carers and parents, stolen.
The attackers – who called themselves Radiant – demanded a Bitcoin ransom worth approximately £600,000, but it was the cyber gangsters’ decision to publish photos of about 20 children by those responsible that prompted a national outcry, forcing them to backtrack. They later claimed they had deleted all of the stolen data, whether or not this is true is not known, and told BBC reporters they were sorry for their actions.
Comparitech security specialist Brian Higgins said the widespread condemnation of the hackers – from the public, the cyber community, and even other criminals, was probably “no small contributor” to their attempted climbdown.
“‘Kudos’ is still a prolific motivator for a lot of young cyber criminals,” he said, “[and] the fact that they demanded a clearly unachievable financial amount from their victims also speaks to their immaturity and lack of sophistication, all of which explains their swift identification and arrest.
“It’s comforting to know that, at least every now and then, the relevant authorities can intervene successfully but this case highlights just how easy it is to carry out such attacks even without the necessary technical expertise one might have needed in the past.
Higgins added: “Unfortunately, given the sheer volume of younger people willing to give cyber crime a go these days, there’s not much of a cautionary tale here.”
Source of concern
The involvement of other UK-based teens in the recent Scattered Lapsus$ Hunters cyber crime spree – victims of which include Marks & Spencer and Jaguar Land Rover – has also prompted a wider national conversation on the topic of how easily many young people in the UK are falling into a life of cyber crime.
The National Crime Agency (NCA) believes around a fifth of 10 to 16 year-olds have engaged in some form of illegal activity online, with 5% of 14-year-olds admitting to hacking. Last year, the agency said, a seven-year-old child was referred to its Cyber Choices digital crime prevention programme.
Meanwhile, the UK’s Information Commissioner’s Office (ICO) recently found that – based on an investigation of over 200 breach reports at schools and universities – over half of insider threat incidents were caused by students. Although such actions often originate as a dare or just a bit of fun, the ICO warned that such activities can all-too-easily escalate into outright criminality.
“The fact that computer misuse is estimated in the millions of incidents per year shows how common hacking behaviour is becoming, especially among the young,” said Check Point head of enterprise Charlotte Wilson.
“We’re seeing pupils treat schools and colleges like testing grounds. It’s time we turned digital mischief into digital mentorship, before curiosity becomes criminality.”
