Companies House issues security statement regarding WebFiling security issue

Companies House was recently made aware of a security issue with their WebFiling service that meant that users who were logged into the service could potentially access and change another company’s details, without the company owner’s knowledge or consent.

They issued a statement and apology on 16 March 2026 after being made aware of the security issue.

What happened?

Ordinarily, you need a company’s authentication code, as well as their company number, to be able to file accounts or make any changes to a company or director’s details using the Companies House WebFiling service.

However, the identified security issue could have allowed other users of the WebFiling system to make unauthorised changes to other companies’ details and potentially make fraudulent filings without needing the company’s authentication code.

Personal data not usually published on Companies House, such as directors’ addresses, dates of birth and email addresses, may also have been visible to other WebFiling users when they were logged into the system. Companies House has stated that they currently have no reports of any data having been accessed or changed without permission. Also, that none of the information used as part of their new identity verification process, such as passport information, was able to be accessed by unauthorised users, nor have any passwords been compromised.

WebFiling was closed from 13.30 on 13 March 2026 to allow for initial investigations. After independent testing, it was opened again at 09.00 on 16 March 2026. These initial investigations have found that the security issue was made possible when their WebFiling systems were updated in October 2025.

Check registered details and filing history

They have asked that all companies check their registered details and filing history to make sure everything appears correct. Accounting firms who usually file information on behalf of clients may be receiving enquiries from clients about this. If you or your clients do identify any anomalies, you should contact Companies House.

Companies House has also acknowledged that filing deadlines may have been missed due to the closure of the WebFiling system. They have asked anyone who missed a filing deadline to file as soon as possible.

The Tax Policy Associates article explains how the security issue was identified and how Companies House were made aware of it.

The Companies House investigation is ongoing and more updates will be made. In the meantime, they have informed both the Information Commissioner’s Office (ICO) and the National Cyber Security Centre (NCSC) of the incident.