The pair, aged 17 and 22, were cuffed in Bishop’s Stortford after a raid on several homes, according to London’s Metropolitan Police. Both remain in custody while detectives grill them on computer misuse and blackmail offences.

The gang behind the attack, calling itself Radiant, bragged about the hack on its dark web portal last month. To prove it wasn’t bluffing, the crew dumped photos, names, home addresses and contact details for ten children it claimed attended one of Kido International’s nurseries.

Kido runs 18 nurseries across Greater London for babies and children up to five years old. The hackers wouldn’t say how much ransom they wanted, but the threat alone has set off fresh alarms about child safety and data protection in Britain.

The attack is the latest in a grim run of ransomware hits this year, with British firms increasingly finding themselves on the wrong end of digital extortion schemes.