The UK Companies House recently disclosed a significant security vulnerability in its WebFiling service that exposed sensitive director information for several months.
Chief Executive Andy King confirmed that the flaw was initially introduced during a system update in October 2025.
This vulnerability allowed authenticated users to potentially view and alter the private details of other companies without their consent.
Upon discovering the critical issue on March 13, 2026, the agency immediately took the online portal offline to prevent further exposure.
After a weekend of independent security testing and system remediation, the platform was safely restored and brought back online on March 16.
Authorization Bypass and Data Exposure
The security defect functioned as a severe authorization bypass, though it was thankfully not accessible to the general public on the open internet.
To exploit this flaw, a potential attacker needed to be a registered system user with a valid authentication code and, once logged into the portal, execute a specific sequence of actions to gain unauthorized access to private corporate records.
This failure in access control meant that sensitive personal data, such as precise dates of birth, residential addresses, and corporate email addresses, was visible to other logged-in users.
Beyond simple data exposure, the vulnerability also allowed bad actors to potentially submit fraudulent official filings, including unauthorized changes to the board of directors or falsified financial accounts.
Despite the severity of this data exposure, Companies House officials confirmed crucial limitations regarding the scope of the breach.
The design of the vulnerability inherently prevented automated web scraping or systematic mass data extraction.
Any unauthorized access was strictly confined to viewing individual company records one at a time, making widespread data theft highly impractical.
Additionally, the agency verified that critical security information remained entirely protected. User passwords were never compromised at any point.
Sensitive identity verification materials, such as scanned passport documents, remained completely isolated from the affected systems.
Existing historical documents that were already filed were also securely locked and could not be altered through this exploit.
Investigation and Remediation Efforts
In response to the incident, Companies House launched an internal investigation and proactively notified both the Information Commissioner’s Office and the National Cyber Security Centre.
Cybersecurity teams are currently conducting forensic analysis of system logs to detect any confirmed instances of unauthorized access.
The agency is contacting all registered corporate addresses to inform them of the situation and provide clear guidance.
Business owners are strongly urged to review their filing histories and registered details carefully. If discrepancies are discovered, companies should file an official complaint with supporting evidence.
Chief Executive Andy King issued a formal apology, assuring the public that the agency will take firm legal action against anyone found exploiting this vulnerability.
The agency also promised to publish a dedicated web page soon to answer further questions and maintain transparency throughout the ongoing investigation.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
