Companies House addresses WebFiling security issue

On Friday 13 March, Companies House discovered a security issue within its WebFiling service. This vulnerability allowed logged-in users to potentially access and modify certain details of another company's account without proper consent after executing specific actions. However, this situation was not accessible to the general public, as only users with an authorised code who were logged into the service could have performed these actions. The response from Companies House was swift; the service was suspended at 1:30 pm on the same day for investigation and resolution.

The service underwent independent testing and resumed operation on Monday 16 March at 9 am. It was revealed that the data potentially at risk included specific information from individual companies that is not typically open to public viewing. This could involve sensitive information such as dates of birth, residential addresses, and company email addresses. There was also a concern that unauthorised filings, including accounts or changes of director, may have been made on another company’s record.

Andy King, Chief Executive of Companies House, assures stakeholders that “passwords were not compromised” and that no data used in the identity verification process, like passport information, was accessed. Furthermore, existing filed documents such as accounts or confirmation statements could not have been altered. The investigation indicated that the issue likely originated during a system update in October 2025.

In light of this incident, Companies House has reported the situation to the Information Commissioner’s Office (ICO) and the National Cyber Security Centre (NCSC). They are actively analysing data to identify any discrepancies and will communicate directly with companies via their registered email addresses. Companies House commented on their commitment, stating, “If we find evidence that anyone has used this issue to access or change another company’s details without authorisation, we will take firm action.”

Companies are encouraged to check their registered details and filing history to ensure accuracy. If any company suspects a security issue, they are advised to reach out to Companies House via email at enquiries@companieshouse.gov.uk with ‘WebFiling issue’ in the subject heading and include supporting evidence.