Companies House screws up again!

[FreddyG]

We all should have received the following email (the German expression "Armutszeugnis" springs to mind!) -

Sent: Wednesday, March 18th 2026, 14:14
Subject: Important information about your Companies House account

This is an official email from Companies House, sent to all registered email addresses, and is relevant to all companies registered in the UK. If you’re a third-party agent who has received this email on behalf of a company, please read and forward this message to the company director(s) of all companies you work with. We are writing to let you know about an issue that affected our WebFiling service, and to explain what you should do next. This advice is relevant to all companies, whether or not you use the WebFiling service to file. On Friday 13 March, we identified an issue with WebFiling. We took the service offline at 1:30pm that day while we investigated and fixed the problem. WebFiling has been independently tested and has been back online since 9am on Monday 16 March. The issue arose from a system update in October 2025 and was not the result of a malicious attempt to attack our systems. It is not a cyber-attack. The issue could only have been exploited by a logged-in user performing a specific set of actions. Our investigation found that it was technically possible for a logged-in registered user to: 1. See certain data not normally published on the public register: the day of the date of birth for directors and PSCs residential address for directors and PSCs company registered email address 2. File updates to any information without consent. For example, new accounts or changes of director. We want to reassure you that: You do not need to reset your WebFiling password. No identity verification data, such as passport information or personal codes, was accessed. No existing filed documents could have been altered. If you have applied to protect your personal details under the Companies Act 2006, your information was not affected by this issue. What you should do now​ We are contacting you proactively on a precautionary basis to make you aware of this issue. At this stage, we have no confirmed reports of any data having been accessed or changed without permission, and we believe the issue could not have been used to extract data in large volumes. However, as a precaution, please check your registered details and filing history to make sure everything looks correct. You can do this in WebFiling and on the Find and update company information service. If anything seems incorrect or unexpected, please contact us on [email protected] using ‘WebFiling issue’ in the subject heading. Please include as much detail as you can about your concern, including your company name and number. The more information you can give us to support our investigation – the easier it will be to resolve the issue for you. Further recommendations​ We also recommend signing up to our free Follow service. Follow sends you an instant email alert whenever a document is filed with us for any company you choose to follow – including your own. It’s a simple way to stay informed and spot anything unexpected as soon as it happens. You can sign up through the Find and update company information service and then select ‘Follow this company’ on your company’s page. Next steps​ We have reported this incident to the Information Commissioner’s Office (ICO). We are analysing our data, and if we find evidence that anyone has accessed or changed another company’s details without authorisation, we will take firm action. We will keep you updated as our investigation progresses. An apology​ We recognise that this incident may have caused concern, and we are sorry for that. Companies House takes its responsibility to protect your data extremely seriously, and we are committed to doing everything we can to support those affected and to maintaining your trust in our services. You’ve received this email because you provided this registered email address to Companies House. You cannot unsubscribe from emails to the registered email address as this is a legal requirement under the Companies Act 2006. We will only use this email address to communicate about your company. The registered email address will not appear on the public register. To change the company’s registered email address, go to: find-and-update.company-information.service.gov.uk/registered-email-address  This is a no-reply email. If you need to contact us because you did not provide this email address as a registered email address, please email [email protected].

 

[Paul Kelly ICHYB]

@Ozzy mentioned this the other day.

 

[Ozzy]

Aye, just linking to the original post;

Companies House Security Breach

This doesn't make great reading; https://www.accountingweb.co.uk/tech/tech-pulse/companies-house-security-blunder-leaves-director-data-exposed So on Friday a really simple way to breach confidential director information was made public, which as it turns out had been in place for ~5 months...

www.ukbusinessforums.co.uk