#241: How Open-Source Cybersecurity Tools Could Have Helped Prevent the Kido International Cyberattack

Cybersecurity is no longer just a problem for large banks or government agencies. Today, schools, nurseries, hospitals, and small businesses are all targets for cybercriminals. Attackers know that organisations holding personal data—especially children’s data—can be pressured into paying quickly after a breach.

A strong example of this is the 2025 cyberattack against Kido International, a nursery and early-years education provider based in Greater London. The attack exposed sensitive personal information involving around 8,000 children and staff, including names, addresses, dates of birth, photographs, and parent contact details. Some of this information was reportedly posted on a dark web leak site, making the incident even more serious.

This attack showed how dangerous modern ransomware and data theft attacks can be. It also raised an important question: could stronger cybersecurity tools have helped prevent the damage?

The answer is yes.

Instead of focusing on expensive commercial security platforms, many organisations can improve protection using powerful open-source cybersecurity tools. Open-source tools are software programs whose code is publicly available, meaning organisations can use, inspect, and improve them without expensive licensing fees. While they still require skilled setup and management, they can provide excellent security when used correctly. Tools such as Wazuh, Suricata, TheHive, MISP, and Velociraptor could have helped reduce the impact of the Kido International attack—or possibly stopped it much earlier.

And that’s important when it comes to development too, including faster tools like Hubspot’s Spotlight.

See what's new for the HubSpot Developer Platform! Ship faster with AI coding tools like Cursor, Claude Code, and Codex. Build MCP-powered AI connectors, run serverless functions with support for UI extensions, and use date-based versioning to streamline roadmap planning.

Take a peek today

Understanding the Kido International Cyberattack

In 2025, Kido International suffered a serious cyberattack believed to involve ransomware and data theft. Attackers reportedly gained access to systems connected to a third-party platform used for storing and sharing children’s photos and developmental records with parents. This is known as a third-party compromise, where hackers target a connected supplier or service provider instead of attacking the main company directly.

The attackers were able to steal sensitive information, including children’s personal profiles. Some of that data was later posted online as part of what appears to be a double extortion ransomware attack. In double extortion, criminals not only encrypt files but also steal data and threaten to release it publicly unless payment is made.

This type of attack is especially harmful because the victims are children. Unlike passwords, personal identity information cannot simply be changed. Families may face privacy and safeguarding concerns for years. Because Kido handles highly sensitive personal data, the incident also created serious legal concerns under UK GDPR and child safeguarding responsibilities.

The main lesson from this breach is clear: early detection and fast response are critical. That is where open-source cybersecurity tools could have made a major difference.

Tool 1: Wazuh for Threat Detection and Monitoring

Wazuh is one of the most powerful open-source security monitoring platforms available today. It combines features of a SIEM (Security Information and Event Management) system with endpoint detection and response (EDR) capabilities. In simple terms, Wazuh collects logs and security events from computers, servers, cloud systems, and user accounts. It then looks for suspicious activity.

For example, if a staff account suddenly logs in from another country at 2:00 AM and starts downloading hundreds of child records, Wazuh can trigger an alert. This is called anomaly detection.

In the Kido attack, if the attackers used stolen credentials through a third-party platform, Wazuh could have detected:

• unusual login locations

• repeated failed login attempts

• privilege escalation

• large file exports

• suspicious administrative activity

Instead of discovering the breach after data was stolen, Kido’s security team could have investigated during the early stages of compromise. This early warning is often the difference between a minor security event and a major public breach.

Tool 2: Suricata for Network Intrusion Detection

Suricata is an open-source Intrusion Detection System (IDS) and Intrusion Prevention System (IPS). Its job is to monitor network traffic and identify malicious behaviour. Think of it like a security guard watching every packet of data entering and leaving the network.