A security flaw at Companies House may have exposed sensitive company and director information.
The issue, linked to a technical error in its WebFiling system, has now been fixed. However, with investigations still ongoing, businesses are being urged to check their records and stay alert.
What happened in the Companies House data breach?
Companies House has confirmed that a flaw in its WebFiling service allowed logged-in users to:
- View certain details linked to other companies
- Potentially amend elements of company records without authorisation.
The issue appears to have been introduced during a system update in October 2025 and may have remained in place for several months before being identified.
What data may have been exposed?
According to Companies House, the data that may have been visible includes:
- Directors’ dates of birth
- Residential addresses
- Company email addresses.
It has also acknowledged that unauthorised filings — such as director changes or company updates — may have been possible in certain circumstances.
Companies House has said there is currently no evidence that passwords or passport details were compromised, and no confirmation that data was actually misused. However, investigations are ongoing.
Why this is a significant data protection failure
This is not just another isolated data incident. Companies House is the UK’s official corporate register, holding records for more than 5 million companies — from small limited businesses through to major listed firms.
That changes the risk profile.
If access controls fail within a system like this, even briefly, it raises wider concerns about:
- Sensitive personal data linked to company directors
- The accuracy of company records
- The reliability of filings relied on by lenders, investors and regulators.
Even the possibility of unauthorised changes raises concerns about how those records could be relied upon during the affected period.
Regulatory involvement and next steps
Companies House has referred the incident to both:
- The Information Commissioner’s Office (ICO)
- The National Cyber Security Centre (NCSC).
It has also said it will contact companies directly and is analysing data to identify any irregularities. At this stage, the full impact is still being assessed.
What businesses should do now
If your business is registered with Companies House, it is worth taking some simple steps:
- Review your company records and recent filings
- Check for any unexpected changes to director or company details
- Monitor communications from Companies House
- Raise concerns if anything appears incorrect.
Even if no issues are immediately visible, staying alert is important while investigations continue.
Could this lead to legal action?
At the moment, there is no confirmed group action linked to this incident. However, as with many data-related events, that position can evolve.
If it becomes clear that individuals or businesses suffered loss, distress or unauthorised data exposure, there may be grounds for further investigation.
At Join the Claim, we monitor developments like this closely. If this situation develops further, we will continue to provide updates — and help you understand what your options might be.
