Companies House faces critical security breach

The UK’s Companies House recently faced a serious security issue affecting its WebFiling service. During this incident, which occurred between 1.30pm on Friday, 13 March, and 9am on Monday, 16 March, logged-in users were potentially able to access and modify elements of another company’s details without consent. This raised concerns over the integrity and confidentiality of sensitive information held by the agency.

In a statement published on the Government’s website, Andy King, Chief Executive of Companies House, explained that sensitive data, including dates of birth, residential addresses, and company email addresses, may have been exposed to other logged-in users. Furthermore, the breach could have allowed for unauthorized filings such as accounts or changes of directors on different companies' records.

James Orloff, a corporate and commercial partner at London law firm Spector Constant & Williams, highlighted the gravity of the situation, stating, “The news of the recent security issue affecting the Companies House WebFiling service is extremely concerning for companies and their officers charged with keeping their public information up to date particularly at a time when the role of Companies House is expanding in light of the reforms brought in by the ECCTA regulations. Users’ confidence in the system is paramount." He further cautioned, “It appears that the issue could have made it possible for unauthorised filings, for instance accounts or changes of director, to have been made on another company’s record. All companies should follow the guidance and check their registered details and filing history to make sure everything on their record appears correct.”

In response to the breach, Companies House shut down the WebFiling service to thoroughly investigate, resolve, and independently test the issue. The government has assured the public that measures are being taken to prevent such breaches in the future, reinforcing the need for robust security protocols within all digital services related to company registrations.