Companies House Suspends WebFiling After Critical Data Breach Vulnerability

The suspension of the Companies House WebFiling service marks a significant failure in the UK’s corporate infrastructure, exposing a vulnerability that experts describe as "insane" in its simplicity. On Friday, the official registrar for UK companies took the unprecedented step of shuttering its primary digital portal after it was revealed that a basic navigation error—simply pressing the "back" button on a browser—could grant users access to the private dashboards of unrelated businesses. This flaw did not require sophisticated hacking tools or social engineering; it was a fundamental breakdown in the website’s session security that left the personal data of millions of directors vulnerable to exploitation.

The data at risk includes some of the most sensitive information held by the registrar: home addresses, dates of birth, and private email addresses of company directors. In the hands of bad actors, this information is a goldmine for identity theft and corporate hijacking. Dan Neidle, the founder of Tax Policy Associates who discovered and reported the glitch, noted that the ability to edit this data is perhaps even more dangerous than the exposure itself. An attacker could theoretically change a company’s registered office address to a location under their control, allowing them to intercept legal documents, bank statements, and sensitive correspondence. Furthermore, the ability to file fraudulent accounts or change directorships could allow criminals to strip assets or take out loans in a company's name before the legitimate owners are even aware of the breach.

“

For major PLCs like AstraZeneca, Shell, and Tesco, the risk is largely reputational and administrative, as these entities have robust internal teams to monitor their filings.

This security lapse comes at a particularly sensitive time for Companies House. The agency is currently in the midst of a multi-year transformation following the passage of the Economic Crime and Corporate Transparency Act. This legislation was designed to give Companies House more power to verify the identities of directors and tackle the use of UK shell companies for money laundering. To have a "no-tech" vulnerability of this magnitude surface now undermines the government's narrative that the UK is becoming a harder place for financial criminals to operate. If the registrar cannot secure the data it already holds, its new mandate to verify and police corporate data will be met with significant skepticism from the business community.