Companies House – WebFiling security issue

Companies House has confirmed that it recently identified a security vulnerability affecting its WebFiling service. The service was suspended as a precaution but has since been secured and restored.

The issue identified on 13 March 2026 meant that logged-in users may have been able to access or amend limited information relating to other companies without their consent. Amendable data included directors’ dates of birth, residential addresses and company email addresses. It may also have been possible for unauthorised filings – such as accounts or changes of director – to have been made on another company’s record.

The vulnerability arose from an update to the WebFiling service in October 2025 as part of the wider reforms introduced under the Economic Crime and Corporate Transparency Act 2023. For more on these reforms, see our blog post here.

Companies House says that, whilst there are no confirmed reports of data having been accessed without permission, companies should:

• review their registered details and filing history and contact Companies House if anything seems incorrect or unexpected; and
• where filings were delayed as a result of the WebFiling service being closed between Friday 13 March and Monday 16 March 2026, file as soon as possible and keep a record of any delay experienced. As the law requires Companies House to automatically apply a late filing penalty if accounts are filed late, companies who were unable to file their accounts on time as a result of the service being down will have to use Companies House’s online service to appeal the penalty.

Companies House has confirmed that no passwords were compromised, identity verification data was unaffected and previously filed documents, such as accounts or confirmation statements, could not have been altered.