Companies House Says WebFiling Flaw May Have Exposed Data for Up to Five Million Companies
Summary
Companies House restored WebFiling after fixing a flaw introduced in October 2025. Logged-in users could reach other companies’ dashboards; some non-public data may have been visible. The agency says it has no reports of unauthorized access or changes, and its inquiry …
Key points
- The flaw, introduced in an October 2025 WebFiling update, could be reached by logged-in users through the “file for another company” flow and browser back button.
- Data for up to five million companies may have been exposed, including dates of birth, residential addresses and company email addresses.
- Companies House said the flaw could have allowed unauthorized filings, but existing filed documents could not have been altered.
- The agency said passwords and identity-verification data, such as passport information, were not accessed.
- Companies House restored the service after fixing the flaw and reported the incident to the ICO and NCSC.
- The agency said it had no reports of unauthorized access or changes at the time of its statement; its investigation is ongoing.
Article Details
- Victim Organization
- Companies House
- Incident Type
- A security flaw in WebFiling allowed logged-in users to access other companies’ dashboards and potentially view or change some company details.
- Data Types Exposed
- Dates of birth
- Residential addresses
- Company email addresses
- Affected Records
- Data for up to five million registered companies may have been visible; the number of records actually accessed is unknown.
- Operational Impact
- Companies House took WebFiling offline to fix the flaw and restored the service. The agency is investigating whether any company records were accessed or changed without permission.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed