17/03/2026
On Friday 13 March, Companies House suspended its WebFiling service after a critical security vulnerability was identified in its systems. The flaw — introduced during a WebFiling system update in October 2025 — allowed any logged-in user to access the private dashboard of any other company registered at Companies House, without needing that company’s authentication code.
The service was suspended at 1.30pm on Friday 13th March. The service was independently tested and restored at 9am on Monday 16 March.
Any company registered at Companies House may have had the following information exposed to unauthorised access:
1. Director names, residential addresses, email addresses, and full dates of birth (normally hidden from public view)
2. Company registered address and contact details
3. The ability to change company details, appoint or remove directors, or upload fraudulent accounts
What you should do now?
1. Check your company’s Companies House record - Log in to WebFiling (now restored) and review your registered details, director information, and filing history. Look for any changes you didn’t authorise, particularly from October 2025 onwards.
2. Look out for Companies House communications - Companies House has confirmed it will email every registered company. Advise clients to watch for this official message and not to dismiss it as spam.
3. Report anything suspicious - If you identify unauthorised changes, raise a formal complaint with Companies House immediately, including screenshots and dates as evidence.
If you have any questions, please feel free to reach out to me.