Companies House closed its WebFiling service on 13th March after it was revealed that a website glitch allowed unauthorised users to view personal data of listed directors and potentially change information or submit fraudulent accounts.

The service was reopened on 16th March after the problem had been investigated, the system tested, and the issue resolved. 

Companies House has confirmed that, although the issue occurred, access was limited to existing users who had authorised codes and log in details for the service.

The investigation found that logged-in users may have been able to view personal information including dates of birth, residential addresses and company email addresses for other directors. 

There is a risk that unauthorised filings could have been made, including changes to accounts or director details. 

So far, there have been no reports of such cases.

Companies House reassured users that passwords and identity verification data, such as passport details, were not accessible during the incident. They also confirmed that no existing filed documents, including accounts or confirmation statements, could have been altered.

The update statement suggested that there was no evidence of any mass data extraction, and any changes made would have had to be carried out individually.

However, it is concerning that the glitch may have been in the system since a system update in October 2025.

In response to the incident, Companies House has notified the Information Commissioner’s Office (ICO) and the National Cyber Security Centre (NCSC). They are reviewing data for any anomalies and will be contacting users with guidance on how to check for any changes.

Companies House has stated that firm action will be taken against any users who exploited this issue to access or change information without authorisation.

Recommended reading

• ICO Issues Guidance on Facial Recognition Technology
• Discord Warns 70,000 Users May Have Had ID Images Accessed
• Discord to Make Age Verification Mandatory In “Teen-by-default” Move

Users with concerns can contact Companies House by emailing enquiries@companieshouse.gov.uk and using ‘WebFiling issue’ in the subject line.

An apology issued by Andy King, chief executive of Companies House read: “I recognise that this incident will have caused concern and inconvenience to many of the companies and individuals who rely on our services. I am sorry for that.

“Companies House takes its responsibility to protect the data entrusted to us extremely seriously. We have taken swift action to secure and restore our service, and are committed to doing everything in our power to support those affected and to making sure that our services continue to merit the trust placed in them”.