Last updated: October 2026
In March 2026, Companies House confirmed a serious security flaw in its WebFiling service. For around five months, the flaw could have exposed private director data for up to 5 million UK companies. Companies House has since fixed the problem and found no evidence of widespread misuse. However, every company director should still check their records.
This guide explains what happened, what data was at risk and the steps you should take now.
What Happened?
The flaw sat inside the Companies House WebFiling system. A logged-in user could try to file for another company and, when asked for that company’s authentication code, press the browser’s back button several times. This gave them access to the other company’s dashboard without permission.
Companies House traced the flaw to a system update in October 2025. A member of the public discovered it, and tax campaigner Dan Neidle reported it to Companies House on Friday 13 March 2026. This was not a sophisticated cyberattack. It was a weakness in Companies House’s own system.
What Data Was at Risk?
The flaw exposed information that is not normally on the public register, including:
- Directors’ dates of birth
- Residential addresses
- Company email addresses
A user exploiting the flaw could also have submitted new filings for another company, such as changes to directors or company accounts. However, Companies House says no existing documents could be altered, no passwords were exposed and no ID verification data was accessed.
What Has Companies House Done?
- Shut down WebFiling on 13 March 2026, the same day it learned of the flaw
- Fixed the vulnerability and restored the service on 16 March 2026
- Notified the Information Commissioner’s Office and the National Cyber Security Centre
- Started reviewing filings made during the exposure window for anything unusual
Companies House also said the flaw could not be used to extract data in bulk. Anyone exploiting it could only view one company record at a time.
What Should Directors Do Now?
- Check your company record: log in to Companies House and confirm your registered office, directors and people with significant control are all correct.
- Review your filing history: look for any filings between October 2025 and March 2026 that you did not make or authorise.
- Report anything wrong: email enquiries@companieshouse.gov.uk with “WebFiling issue” in the subject line.
- Watch for scams: fraudsters may use leaked dates of birth or home addresses to make calls and emails look genuine. Never share codes or passwords with anyone who contacts you unexpectedly.
- Complete your ID verification: director identity verification makes it much harder for anyone to file changes in your name.
How Identity Verification Helps Protect Your Company
Since 18 November 2025, every company director must verify their identity with Companies House. New directors verify when they join. Existing directors verify with their next confirmation statement. Verification links each director to a confirmed identity, which makes fraudulent filings harder.
Direct Assist Accountants is a Companies House Authorised Corporate Service Provider (ACSP). Our director ID verification service can complete this for you and your fellow directors.
Why This Matters for Small Businesses
This incident shows that even official systems carry risks. Small business owners should not assume their public records are always correct. A quick check a few times a year can stop a small issue from becoming a serious problem, especially if someone tries to change your directors or registered office.
If you have just formed a company, our first-year compliance checklist covers every Companies House and HMRC deadline you need to know.
How Direct Assist Accountants Can Help
We help directors across Slough and the Thames Valley keep their Companies House records accurate and secure. Our limited company accounting service includes:
- Regular checks of your company record and filing history
- Director ID verification as an ACSP
- Confirmation statements and annual accounts filed on time
- Help reporting and correcting any unauthorised changes
If you are worried about your company’s records, contact Direct Assist Accountants for a free review.