Companies House Security Breach: A Deep Dive into the WebFiling Glitch

On March 13, 2026, Companies House, the UK government agency responsible for registering companies, identified a significant security issue within its WebFiling service. This flaw allowed logged-in users to potentially access and alter details of other companies without consent. The breach was discovered by John Hewitt, a corporate services provider, who reported the vulnerability after observing unusual access behavior while navigating the platform. Following the discovery, Companies House temporarily shut down the WebFiling service for investigation and resolution.

Companies House faces critical security breachBBC NewsTechRadarCompanies House chief apologises over data breachThe Register UKUpdate on Companies House WebFiling security issue

The security issue enabled unauthorized access to sensitive data, including directors' home addresses, dates of birth, and company email addresses. It also raised concerns that unauthorized filings, such as changes to directors or financial accounts, could have been made on other companies' records. Companies House clarified that the breach was not accessible to the general public and was limited to users with authorized access to the WebFiling service. Importantly, passwords and identity verification data, such as passport information, were not compromised.

Companies House chief apologises over data breachCompanies House faces critical security breachThe Register UKTechRadarBBC NewsUpdate on Companies House WebFiling security issue

• March 13, 2026: Companies House became aware of the security issue and closed the WebFiling service at 1:30 PM.

Companies House faces critical security breach

• March 16, 2026: The service was restored at 9:00 AM after independent testing confirmed the resolution of the issue.

The Register UK

Andy King, CEO of Companies House, issued an apology for the incident, acknowledging the concern and inconvenience caused to companies relying on their services. He emphasized the agency's commitment to data protection and transparency, stating, "Companies House takes its responsibility to protect the data entrusted to us extremely seriously." The agency has reported the incident to the Information Commissioner's Office (ICO) and the National Cyber Security Centre (NCSC) and is actively analyzing data to identify any anomalies.

The Register UK

Legal experts and industry professionals have expressed concern over the implications of the breach. James Orloff, a corporate and commercial partner at Spector Constant & Williams, highlighted the gravity of the situation, stating that the incident undermines user confidence in the system, especially as Companies House's role expands under new regulations. He urged all companies to verify their records to ensure accuracy.

Companies House faces critical security breach

While Companies House has stated that there are currently no reports of data being accessed or altered without permission, the ongoing investigation may reveal further details. The agency has not confirmed whether any unauthorized changes were made during the five-month period the vulnerability was active.

All UK firms urged to check Companies House records after data exposed during five-month ‘security issue’

Companies House is set to provide further updates as its investigation continues. The agency plans to email all registered companies with guidance on checking their details and reporting any concerns. Additionally, it will publish a dedicated page with more information regarding the security issue.

Companies House chief apologises over data breach

• “I recognize that this incident will have caused concern and inconvenience to many of the companies and individuals who rely on our services. I am sorry for that.” — Andy King, CEO, Companies House

The Register UK

• “Companies House takes its responsibility to protect the data entrusted to us extremely seriously.” — Andy King, CEO, Companies House

Update on Companies House WebFiling security issue

• “The news of the recent security issue affecting the Companies House WebFiling service is extremely concerning for companies and their officers charged with keeping their public information up to date particularly at a time when the role of Companies House is expanding in light of the reforms brought in by the ECCTA regulations. Users’ confidence in the system is paramount.” — James Orloff, Corporate Partner, Spector Constant & Williams

Companies House faces critical security breach

This incident underscores the importance of robust security measures in digital services, particularly those handling sensitive business information. Companies House is committed to restoring trust and ensuring the integrity of its services moving forward.

The Register UK