IT Essentials: A ‘stupidly simple’ glitch

Here we are again

The Companies House website glitch gathered limited attention in a stacked news cycle. But ‘Know Your Business’ processes using Companies House data have just been compromised – millions of times over.

With all the horrors dominating the news, it’s perhaps understandable that the reporting last week of a ‘glitch’ on the Companies House website - one that allowed anyone, for months, to access the private dashboard of one of the UK’s five million companies - barely registered.

In the words of tax specialist Dan Neidle, who uncovered it, the flaw was “stupidly simple.” Log into your own company dashboard, try to view another company, hit the back button four times and you were in. That meant access to directors’ personal data such as home addresses and dates of birth. The data wasn’t just visible; it could be altered.

A digital goldmine for fraudsters, requiring zero skill.

Companies House took the WebFiling service offline as soon as it was alerted, and Neidle held back from going public until then. The issue was fixed over the weekend.

So, no harm done? Not quite. We simply don’t know. The tone of the email sent to registered users was notably relaxed, describing a “specific set of actions” (hitting the back button four times) that could allow data modification. The mail also informed recipients that this was very definitely not a cyberattack.

This was technically accurate, but it downplayed the risk that data may have been quietly changed and later used in fraud.

That uncertainty is the core problem. If data was altered, the consequences may not be immediate or obvious. We are left without a clear picture of the scale or impact.

So here we are again

Another breach not driven by sophisticated attackers, but by a basic, easily exploitable flaw, probably the product of poor application security, patching, or change management. And a response that feels distinctly familiar: calm to the point of incuriosity.

Don’t worry! There’s no evidence of exfiltration of data, no evidence of fraud, no evidence of personal data loss. No evidence of criminal activity. No evidence of hostile state involvement.

The advice is simply to check your data and if it’s how you left it, don’t worry.

In fairness, an investigation may still be ongoing. But it doesn’t take the imagination of a paranoid conspiracist to see how this vulnerability could be combined with cheap, AI-enabled deepfakery to produce convincing phishing emails, messages, or even video calls.

Which raises a more uncomfortable question: how much confidence should we place in due diligence and Know Your Business processes built on data from Companies House? Should it still be treated as a pre-validated source of truth?

It may take weeks or months, but the risk of fraud emerging as a delayed consequence of this “glitch” is obvious.

In the meantime, it might be prudent to take a hard look at KYB processes.

There are still handful of places left for the for the Security Leaders Summit this Thursday 26th March in Moorgate.

If you would like to her from experts and peers on subjects like the practicalities of moving away from US tech, how to attract Gen Z talent and how to cope when the playbook breaks as well as hearing about Computing's exclusive research, click here to register.