Attention: UK company directors and any Companies House users

Companies House has confirmed that, due to a security flaw with WebFiling in existence since October 2025 which was discovered on Friday 13 March, logged-in users have been able to potentially alter certain information held on other companies – without consent.

The flaw also gave users access to non-public data. This includes the day of the date of birth for directors and PSCs, company registered email addresses and residential addresses for directors and PSCs.

Companies House has confirmed that the issue was fixed and the WebFiling service has been back online since 9am on Monday 16 March.

This is yet another reminder that personal data can never be 100% secure in our online world. Thankfully, Companies House has confirmed that passwords and other information provided as part of the ID verification process (e.g. personal codes and passport details) were not compromised, providing a measure of comfort.

In relation to information held on companies and LLPs, Birketts strongly recommends that directors take the following urgent steps (which should take no more than five minutes):

1. Go to https://find-and-update.company-information.service.gov.uk/search?q= and search for your company (ideally by using the company registered number, not the name).
2. Review the ‘filing history’ tab and check that there have been no unexpected filings made in the past six months (e.g. changes to the company name or registered office, filings of accounts and confirmation statements, changes to officers or PSCs or the registration or discharge of any charges).

Companies House has confirmed that this vulnerability arose from a system update carried out in October 2025 and was not a result of a malicious attack or a cyber-attack. For any users of Companies House who are relying on its data for transactional purposes – in particular banks, financial institutions, credit agencies, lawyers, accountants, and anyone who interrogates Companies House information as part of commercial due diligence – extra care should be taken, particularly to ensure that any filings made since October 2025 are checked and verified. To reiterate, Companies House has confirmed that the issue has been rectified and the WebFiling service is fully operational having been independently tested.

The above also applies to overseas companies with a UK establishment (branch).

If anyone has any questions, please get in touch with your usual Birketts contacts.