Companies House shuts filing service after security flaw

UK’s corporate register exposes directors' personal details

The UK's corporate register, Companies House, has temporarily shut down its online filing service after a technical flaw exposed sensitive personal details of company directors.

The government agency confirmed that a bug in its website inadvertently made information such as directors' residential addresses, email addresses and full dates of birth visible to members of the public.

These details are stored by Companies House but are not intended to be publicly accessible.

The flaw also created the risk that malicious users could amend company records or upload fraudulent accounts.

Companies House oversees more than 5 million businesses listed on the UK's official corporate register, including major FTSE 100 firms such as AstraZeneca, Tesco and Shell.

The security issue reportedly allowed users to reach an editing page without authentication by entering a company's registration number and repeatedly pressing the "back" button on their web browser.

This sequence could lead to a section of the site where filings might be amended.

The Financial Times said it was able to view a director's personal details with the individual's permission while investigating the flaw.

The vulnerability was discovered by John Hewitt, who runs the business services provider Ghost Mail. Hewitt contacted Dan Neidle, founder of the non-profit group Tax Policy Associates, who then alerted Companies House about the vulnerability.

Writing on X, Neidle warned: "Anyone who owns a company should check its Companies House details right now."

In a blog post, he said it was unclear how long the vulnerability had existed or whether it had been exploited. He added that while the flaw could theoretically allow large companies' boards to be replaced with fictitious names, criminals would more likely target smaller firms.

Companies House said it had closed its WebFiling service while the issue was investigated.

"We are aware of an issue with our WebFiling service and have closed it while we investigate," a spokesperson said.

"We apologise for any inconvenience to our customers."

The agency advised companies that they should submit filings once the system is restored and keep evidence if technical problems prevented them from meeting deadlines.

Small businesses voice concern

Business groups reacted with alarm to the breach. The Federation of Small Businesses described the situation as a "shocking breach" that could undermine trust in the system designed to protect corporate information.

Alan Soady, the organisation's communications director, said many small companies would question the value of the fees they pay to Companies House.

"This will cause many small business owners to ask exactly what it is they are paying for," he said, adding that the incident should halt plans for further fee increases.

Soady added that the growing bureaucracy surrounding company registration and reporting requirements was already placing strain on small firms.

The incident is the latest challenge for Companies House, which was granted new powers in recent years to improve the accuracy of company records and tackle misuse of the register.

Those reforms introduced identity verification for directors following a wave of bogus company registrations using fictitious names such as Adolf Tooth Fairy Hitler and Donald Duck.

Under the UK's Computer Misuse Act, accessing computer systems without authorisation can be a criminal offence.

Penalties can include up to two years in prison, or up to five years if the access is linked to further offences.

Update: Companies House says the filing service is now back online. A spokesperson said, “We closed WebFiling at 1:30pm on Friday 13 March while we investigated and resolved the issue. The service has been independently tested and is back online as of 9am on Monday 16 March.”