Companies House closes WebFiling over a flaw that let users see and change other companies' details
Companies House shut WebFiling on 13 March 2026 after finding that a logged-in user could, through a specific sequence of actions, view and change parts of another company's record. Unpublished data such as dates of birth, residential addresses and company email addresses may have been visible, and unauthorised filings may have been possible. The flaw dated from an October 2025 update. Every company was asked to check its details and filing history.
Companies House learned on Friday 13 March 2026 of a security issue in its WebFiling service and closed the service at 1:30pm that day. After independent testing it reopened at 9am on Monday 16 March, when the Chief Executive, Andy King, issued a statement.
What happened
- A user logged in to WebFiling with an authentication code could, after a specific set of actions, access and change some details of another company without consent. The general public could not.
- Data not normally published may have been visible, including dates of birth, residential addresses and company email addresses.
- Unauthorised filings, such as accounts or changes of director, may have been possible on another company's record. Existing filed documents could not be altered.
- Passwords and identity verification data were not affected. Companies House said the flaw could not be used to extract data in bulk.
- The issue was introduced in a WebFiling update in October 2025.
What Companies House did
It reported the incident to the Information Commissioner's Office and the National Cyber Security Centre, and emailed every company's registered email address between 17 and 19 March explaining how to check its records.
What to do
Check each company's registered details and filing history for anything unexpected, and report concerns to Companies House with evidence, using 'WebFiling issue' in the subject line.
Later developments
Companies House published a further update on its investigation in April 2026. See our coverage.