Radiant Group won't touch kids' data now, but apparently hospitals are fair game
(2025/10/06)
- Reference: 1759756849
- News link: https://www.theregister.co.uk/2025/10/06/radiant_group_hospital/
- Source link:
First they targeted a preschool network, now new kids on the ransomware block Radiant Group say they've hit a hospital in the US, continuing their deplorable early cybercrime careers.
With just three claimed victims on its website, including preschool network Kido Schools, Radiant Group today gave a Minnesota hospital seven days to comply with its demands or risk having its data plastered online.
The ransomware crooks have not yet named the hospital, but said they would identify it if their extortion demands are unmet.
[1]
Radiant added the hospital to its data leak site in the early hours of Monday morning – the latest victim it claimed to have attacked since spinning up in September.
[2]
[3]
The group mired itself in controversy following its [4]inaugural attack on Kido International , primarily due to it leaking images of preschoolers along with their parents' contact details.
It wasn't just media and cybersecurity pressure that prompted Radiant to cover its tracks; a rival ransomware crew also appears to have played a role.
[5]
Rebecca Taylor, a threat intelligence knowledge manager at security biz Sophos, told [6]The Register last week that the Nova group chastised Radiant on the Russian hacker forum [7]RAMP for its treatment of young people. In response, Radiant agreed to remove the children's data.
Kido International's listing on Radiant's website now reflects that, with the group saying one of its affiliates went rogue.
"All data relating to Kido Schools International has been deleted," its website now reads. "One of our partners violated our rules by targeting a childcare company. Therefore, we will not continue any leakage of this childcare company, and they have been provided with a security report and deletion log."
[8]
We asked Kido to confirm the veracity of Radiant's claims, specifically about providing a deletion log.
A spokesperson for the preschool network said: "We understand that the group responsible has unilaterally elected to delete data they copied. We have continued to monitor their site and can confirm they have removed the information they previously published."
[9]No suds for you! Asahi brewery attack leaves Japanese drinkers dry
[10]Red Hat fesses up to GitLab breach after attackers brag of data theft
[11]Ransomware scumbags say they deleted kids' info after other gangs called them out
[12]Callous crims break into preschool network, publish toddlers' data
"Throughout this incident, we have followed guidance from the authorities that discourages ransom payments as they only fuel and incentivise further criminal activity. We continue to work closely with families, regulators, law enforcement, and our cybersecurity experts, to investigate and take active steps to confirm that the data is permanently deleted."
According to Taylor, Radiant said that during the RAMP discussion of its attack on Kido it forbade any attacks that involve children's data.
"We have disabled any attacks relating to them, is not allowed anymore," it said.
So children are a no-go, yet [13]hospitals are seemingly fair game.
Little is known about Radiant Group, although the cyber sleuths at malware collector vx-underground, who claim to have spoken with its hierarchy after the Kido attack, [14]said they appear to be native English speakers and understand how the UK school system works.
They said Russian ransomware groups tend not to have a great understanding of what data they steal from Western organizations or how damaging it could be if leaked. ®
Get our [15]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aOPnmyzW_zYw9MYrcLXxpAAAARU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aOPnmyzW_zYw9MYrcLXxpAAAARU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aOPnmyzW_zYw9MYrcLXxpAAAARU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2025/09/25/ransomware_gang_publishes_toddlers_images/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aOPnmyzW_zYw9MYrcLXxpAAAARU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2025/10/02/ransomware_radiant_delete_kids_info/
[7] https://www.theregister.com/2021/12/02/ransomware_forums_revealed/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aOPnmyzW_zYw9MYrcLXxpAAAARU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://www.theregister.com/2025/10/03/asahi_beer_attack/
[10] https://www.theregister.com/2025/10/03/red_hat_gitlab_breach/
[11] https://www.theregister.com/2025/10/02/ransomware_radiant_delete_kids_info/
[12] https://www.theregister.com/2025/09/25/ransomware_gang_publishes_toddlers_images/
[13] https://www.theregister.com/2025/03/10/rhysida_healthcare/
[14] https://x.com/vxunderground/status/1972099090281275619
[15] https://whitepapers.theregister.com/
With just three claimed victims on its website, including preschool network Kido Schools, Radiant Group today gave a Minnesota hospital seven days to comply with its demands or risk having its data plastered online.
The ransomware crooks have not yet named the hospital, but said they would identify it if their extortion demands are unmet.
[1]
Radiant added the hospital to its data leak site in the early hours of Monday morning – the latest victim it claimed to have attacked since spinning up in September.
[2]
[3]
The group mired itself in controversy following its [4]inaugural attack on Kido International , primarily due to it leaking images of preschoolers along with their parents' contact details.
It wasn't just media and cybersecurity pressure that prompted Radiant to cover its tracks; a rival ransomware crew also appears to have played a role.
[5]
Rebecca Taylor, a threat intelligence knowledge manager at security biz Sophos, told [6]The Register last week that the Nova group chastised Radiant on the Russian hacker forum [7]RAMP for its treatment of young people. In response, Radiant agreed to remove the children's data.
Kido International's listing on Radiant's website now reflects that, with the group saying one of its affiliates went rogue.
"All data relating to Kido Schools International has been deleted," its website now reads. "One of our partners violated our rules by targeting a childcare company. Therefore, we will not continue any leakage of this childcare company, and they have been provided with a security report and deletion log."
[8]
We asked Kido to confirm the veracity of Radiant's claims, specifically about providing a deletion log.
A spokesperson for the preschool network said: "We understand that the group responsible has unilaterally elected to delete data they copied. We have continued to monitor their site and can confirm they have removed the information they previously published."
[9]No suds for you! Asahi brewery attack leaves Japanese drinkers dry
[10]Red Hat fesses up to GitLab breach after attackers brag of data theft
[11]Ransomware scumbags say they deleted kids' info after other gangs called them out
[12]Callous crims break into preschool network, publish toddlers' data
"Throughout this incident, we have followed guidance from the authorities that discourages ransom payments as they only fuel and incentivise further criminal activity. We continue to work closely with families, regulators, law enforcement, and our cybersecurity experts, to investigate and take active steps to confirm that the data is permanently deleted."
According to Taylor, Radiant said that during the RAMP discussion of its attack on Kido it forbade any attacks that involve children's data.
"We have disabled any attacks relating to them, is not allowed anymore," it said.
So children are a no-go, yet [13]hospitals are seemingly fair game.
Little is known about Radiant Group, although the cyber sleuths at malware collector vx-underground, who claim to have spoken with its hierarchy after the Kido attack, [14]said they appear to be native English speakers and understand how the UK school system works.
They said Russian ransomware groups tend not to have a great understanding of what data they steal from Western organizations or how damaging it could be if leaked. ®
Get our [15]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aOPnmyzW_zYw9MYrcLXxpAAAARU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aOPnmyzW_zYw9MYrcLXxpAAAARU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aOPnmyzW_zYw9MYrcLXxpAAAARU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2025/09/25/ransomware_gang_publishes_toddlers_images/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aOPnmyzW_zYw9MYrcLXxpAAAARU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2025/10/02/ransomware_radiant_delete_kids_info/
[7] https://www.theregister.com/2021/12/02/ransomware_forums_revealed/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_specialfeatures/cybersecuritymonth&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aOPnmyzW_zYw9MYrcLXxpAAAARU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://www.theregister.com/2025/10/03/asahi_beer_attack/
[10] https://www.theregister.com/2025/10/03/red_hat_gitlab_breach/
[11] https://www.theregister.com/2025/10/02/ransomware_radiant_delete_kids_info/
[12] https://www.theregister.com/2025/09/25/ransomware_gang_publishes_toddlers_images/
[13] https://www.theregister.com/2025/03/10/rhysida_healthcare/
[14] https://x.com/vxunderground/status/1972099090281275619
[15] https://whitepapers.theregister.com/
Re: Drawing a line
Anonymous Coward
It all feels like theater. At this point I wouldn't be shocked they're really on a US airbase, a carveout from some NDAA meant to keep the security theater going.
Drawing a line
The question is where do they consider to be off limits, and where is 'fair game'? That pre-school children are 'off limits', considering the reaction to the Kido hack is no surprise, but that a hospital and its patients are considered 'fair game' when medical treatment is costly enough already, seems to me a bit challenging. Are they going to check any data they release to remove treatment details of children? Of course a child can be upset if their parent's or loved one's medical history is published. I am not convinced that 'Radiant Group' has thought this through (although why I would expect self confessed criminals to do so probably shows my naïvety rather than anything else).