Companies House Security Issue: UK Firms Urged to Check Details
The flaw exposed sensitive details like dates of birth and addresses to logged-in users and was fixed after being introduced in October 2025.
- On Monday, Companies House restored its WebFiling service after resolving a security flaw that allowed logged-in users to access and edit private data belonging to other firms.
- An internal investigation suggests the glitch originated during a WebFiling system update in October, remaining undetected until John Hewitt, director of operations at Ghost Mail, identified the vulnerability on Thursday.
- The bug exposed data for 5 million companies, potentially allowing users to access directors' residential addresses, dates of birth, and company emails through repeated browser back-button presses.
- Companies House CEO Andy King apologized for the incident and reported it to the Information Commissioner's Office and National Cyber Security Centre, confirming that passwords remained secure.
- King vowed to take "firm action" if evidence of misuse emerges, while the agency emails businesses with guidance on checking their registered details for unauthorized changes.
13 Articles
13 Articles
'Astonishing' Companies House data breach exposed millions of director's private information for months
A significant security vulnerability in the Companies House WebFiling system may have left the personal details of millions of UK company directors exposed for approximately five months, it has emerged.The flaw, which was introduced during a system update in October 2025, potentially allowed logged-in users to view and modify other firms' confidential information without authorisation.Sensitive data including residential addresses, dates of birt…
Coverage Details
Bias Distribution
- 50% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium






