Companies House is asking all registered companies to check their registered details and filing history to make sure everything appears correct, following a security issue.
In a statement from Andy King, Chief Executive of Companies House, he said last Friday Companies House was made aware of a security issue which meant that a logged-in user of its WebFiling service could potentially access and change some elements of another company’s details without their consent after performing a specific set of actions.
He said this issue was introduced when it updated its WebFiling systems in October 2025.
blob:https://www.intelligentsme.tech/8dac7a0f-1c71-45e4-9340-862e7e323428
King said WebFiling was closed on Friday at 1.30pm and the issue was resolved and it was back online on Monday at 9am.
Change block type or style
Move Paragraph block from position 4 up to position 3
Move Paragraph block from position 4 down to position 5
Change text alignment
Displays more block tools
blob:https://www.intelligentsme.tech/8dac7a0f-1c71-45e4-9340-862e7e323428
The statement said: “Our investigation has established that specific data from individual companies not normally published on the Companies House register may have been visible to other logged-in WebFiling users. This includes dates of birth, residential addresses and company email addresses. It may also have been possible for unauthorised filings – such as accounts or changes of director – to have been made on another company’s record.”
Passwords were not compromised, no data used as part of the identity verification process, such as passport information, was accessed and no existing filed documents, such as accounts or confirmation statements could have been altered.
Aman Parmar, Head of Marketing at BizSpace, a leading provider of flexible workspaces for SMEs, said: “For most SME owners, Companies House is something you simply trust: this incident changes that overnight. The idea that someone could potentially access your company dashboard, view sensitive director data and even attempt to make changes is deeply unsettling, and it’s exactly the kind of vulnerability that fraudsters look for.
“What makes this particularly alarming is how simple the flaw appears to have been. According to reports, users may have been able to access other companies’ records with nothing more than basic navigation tricks, exposing personal data such as home addresses, dates of birth and email addresses. That kind of information is gold dust for criminals, whether that’s phishing, identity theft or impersonation.
“This incident isn’t happening in a vacuum – British SMEs are already operating in a much tougher risk environment than they were even two years ago. Cybercrime is now one of the most common threats facing businesses, with government data showing around 43% of UK firms experienced a cyberbreach or attack in the past year. The National Cyber Security Centre is dealing with the equivalent of four major cyber incidents every week, and have issued a warning to organisations to strengthen their cyberdefences further following geopolitical tensions in the Middle East, which may heighten the risk of cyberthreat.”
He added: “Once sensitive company data is exposed, it can be used weeks or even months later in highly targeted scams that are much harder to spot. That’s why the urgency here can’t be overstated. This isn’t something to review next quarter or leave to your accountant at year-end – every SME director should be logging into Companies House as soon as possible and checking for anything that doesn’t look right.”
