Update on Companies House WebFiling security issue

Companies House has recently issued an update on a security issue affecting its WebFiling service. While the situation has understandably caused concern, the latest guidance provides helpful clarity on what happened and how it has been addressed by them.

What happened

The issue relates to a technical flaw introduced during an update to the WebFiling system in October 2025. This flaw meant that, under specific circumstances, a logged-in user could potentially access limited information from another company’s record.

In some cases, this included data that is not usually publicly available, such as partial personal details of company officers. There was also a possibility that certain company details could be viewed or amended without proper authorisation.

Importantly, this was not a cyber-attack. Access required a user to be logged into the WebFiling service, and any exposure was limited to one company record at a time rather than large-scale data extraction.

How Companies House responded

Once the issue was identified in March 2026, Companies House acted quickly. The WebFiling service was temporarily taken offline while investigations were carried out and a fix was implemented.

The organisation has confirmed that the issue has now been resolved and the service safely restored. It has also reported the incident to the Information Commissioner’s Office and the National Cyber Security Centre as a precaution.

What this means for businesses

Companies House are contacting companies proactively on a precautionary basis. At this stage, there have no confirmed reports of data being accessed or changed without permission and believe the issue could not have been used to extract large volumes of data.

However, as a matter of good governance, we recommend that businesses may wish to review their company records and recent filings to ensure everything appears accurate. This is a sensible step following any technical incident, even where there is no evidence of widespread misuse. You can do this in WebFiling and on the Find and update company information service.

For all Gravita Company Secretarial clients, this should not be a problem as our service includes constant monitoring of each company’s filing history. Every night all companies are checked against the records held at Companies House. This includes the flagging of any new filing history items. These are checked individually, and any discrepancies would be investigated further and raised with you directly if they could not be explained.

Overall, the update reflects a contained issue that has been addressed, with further safeguards and monitoring now in place.