Companies urged to check their Companies House filings following cyber incident

On Friday, 13th March 2026, Companies House announced that it was suspending online filing. In a statement published on the Companies House website on Monday, 16th March 2026, Companies House’s CEO, Andy King, explained that users who were logged into the Companies House WebFiling could potentially access and change elements of another company’s details without their consent. The statement explained that WebFiling had been closed at 1.30 pm on Friday, 13th, whilst Companies House investigated and resolved the issue, and then re-opened at 9 am on Monday, 16th.

Companies House revealed that its investigation indicated that the issue may have existed for five months, when the WebFiling system was updated in October 2025.  It also confirmed that some personal data that was not usually visible may have been visible to other users logged in, such as:

• dates of birth;
• residential addresses; and
• company email addresses.

The investigation further concluded that it may have been possible to submit unauthorised company filings, such as accounts or changes of director, to another company’s records. It is unclear whether such changes would be implemented.  Companies House identified that the following were not affected by the incident:

• Passwords were not compromised.
• No data used as part of the new identification verification process, such as passport information, was accessed.
• No existing filed documents, such as accounts, could have been altered.

Companies House has also determined that the information was not generally accessible to members of the public, but only to those logged into the WebFiling system.

The matter has been referred to the UK regulator of data protection, the Information Commissioner’s Office and the National Cyber Security Centre.

Mr King also issued an apology on behalf of Companies House.

“I recognise that this incident will have caused concern and inconvenience to many of the companies and individuals who rely on our services. I am sorry for that.

Companies House takes its responsibility to protect the data entrusted to us extremely seriously. We have taken swift action to secure and restore our service, and are committed to doing everything in our power to support those affected and to making sure that our services continue to merit the trust placed in them.”

Comment

It is important that those who file documents on the Companies House WebFiling platform check that there are no unauthorised filings or other suspicious activity.  If you notice information that does not appear to be correct, Companies House ask that you raise a complaint directly, which it will then investigate.

Companies (and also LLPs that are registered at Companies House) should be alert to possible changes in their credit history, or the opening of new accounts.  It is not just the company itself that may be vulnerable.  It is possible that fraudsters may gain access to other personal accounts of directors or create a new bank account, using information such as date of birth and home address that might have been identified through this issue.

JMW has published a comprehensive guide about identity fraud, and we encourage you to read the guide to understand the steps to take to identify and prevent identity fraud or any other kind of fraud.