The UK’s official corporate register has suspended its online filing service after a website glitch exposed sensitive personal data and raised concerns that company records could be altered by unauthorised users.

Companies House confirmed it had shut down its WebFiling service after a vulnerability allowed members of the public to view and potentially change directors’ personal information, creating a risk of fraud or other criminal activity.

The registry maintains records for more than five million companies across the UK economy, including those of major FTSE 100 businesses such as AstraZeneca, Shell and Tesco.

Personal data held by the registry – including directors’ addresses, email addresses and full dates of birth – is not intended to be publicly visible. However, the details became accessible due to a bug on the Companies House website. The issue also created the possibility that criminals could amend company details and upload fraudulent accounts.

The flaw allowed users to reach a page enabling changes to corporate filings simply by entering a company number and repeatedly pressing the “back” button on their web browser. The vulnerability meant individuals could potentially gain access to information about company directors or alter corporate records.

The glitch marks another setback for Companies House, which was granted additional powers two years ago to improve the quality and reliability of data held on the corporate register and to tackle abuse of the system.

Those reforms followed a series of high-profile examples of bogus companies and directors being registered – under the updated rules, company directors must now verify their identity.

Companies House said: “We are aware of an issue with our WebFiling service and have closed it while we investigate. We apologise for any inconvenience to our customers.”

To prevent further risk while the issue is investigated, the organisation has suspended the option to update company details online.

Recommended reading

• ICO Issues Guidance on Facial Recognition Technology
• Discord Warns 70,000 Users May Have Had ID Images Accessed
• Discord to Make Age Verification Mandatory In “Teen-by-default” Move

The duration of the vulnerability remains unclear, and Companies House is investigating how long the flaw may have existed.

Neidle said: “The best option would be that the bug has only been there for a couple of days and Companies House might be able to identify which companies were accessed and update them and warn them.

“On the other hand the bug has been there for a long time, unidentified, and Companies House can’t see the impact on what that might have had on filings.”

Under the Computer Misuse Act 1990, unauthorised access to computer material carries a maximum prison sentence of two years. The penalty can rise to up to five years if the access is used to commit further offences such as fraud.