Data Breach - UK's Corporate Registry Flaw Exposed Records
Basically, a flaw let company directors see private info from other companies.
A serious security flaw in the UK's corporate registry exposed sensitive data of company directors. This breach raises concerns about data protection and trust in government services. Companies House has taken action to address the issue and is investigating potential misuse.
What Happened
On March 13, 2026, the UK's Companies House had to shut down its WebFiling service due to a significant security flaw. This issue allowed logged-in users to access and potentially modify confidential information from rival companies. The flaw was first reported by tax professional Dan Neidle, who demonstrated how easily it could be exploited on social media. Following this revelation, Companies House acted swiftly to secure the platform, bringing it back online by March 16.
The flaw stemmed from changes made to the WebFiling platform in October 2025. These changes inadvertently allowed directors to view hidden data from other companies by using the browser's back button after attempting to log in to another company's account. This could have led to unauthorized access to sensitive information, including dates of birth and residential addresses.
Who's Affected
The incident primarily affects company directors and businesses registered with Companies House. As the central registry for UK businesses, it holds sensitive data crucial for maintaining corporate integrity. Directors could have accessed the personal details of their competitors, leading to potential misuse of this information.
While the flaw was limited to individual records and did not allow mass data extraction, the implications of such a breach can be severe. Trust in the corporate registry is vital for maintaining a fair business environment. If directors exploited this flaw, it could undermine the integrity of the entire registry system.
What Data Was Exposed
The exposed data included sensitive personal information that is not typically available to the public. This includes:
- Dates of birth
- Residential addresses
- Company email addresses
Although Companies House confirmed that passwords and identity verification documents were not accessible, the potential for unauthorized filings still posed a significant risk. The agency is currently investigating whether any unauthorized changes were made to company records during the time the flaw was active.
What You Should Do
If you are a company director or business owner, it is essential to stay informed about this incident. Here are some steps to consider:
- Monitor your company records: Regularly check your business information on Companies House for any unauthorized changes.
- Review security practices: Ensure that your company has robust security measures in place, especially regarding sensitive data management.
- Stay updated: Follow Companies House announcements for any further developments related to this breach.
Companies House has committed to taking firm action if evidence of exploitation is found. They are also working closely with the Information Commissioner's Office and the National Cyber Security Centre to address the situation and enhance data protection measures.
The Register Security