Companies House Suspends WebFiling After Critical Data Vulnerability Exposed

The suspension of the UK’s Companies House WebFiling service marks a significant failure in the digital infrastructure underpinning the British economy. On March 13, 2026, the registrar was forced to take its primary online filing portal offline after a critical security vulnerability was brought to light. The flaw was not the result of a sophisticated cyberattack but rather a fundamental failure in session handling and data authorization. Specifically, users reported that by simply using the "back" button on their web browser, they could gain unauthorized access to the dashboards of other companies. This allowed for the viewing and, more alarmingly, the editing of sensitive corporate and personal data.

The implications of this breach extend far beyond a mere technical glitch. For a registrar that holds the records of millions of businesses, including global giants like AstraZeneca, Shell, and Tesco, the integrity of its data is paramount. The vulnerability exposed directors’ home addresses, dates of birth, and email addresses—the exact data points used by financial institutions for Know Your Customer (KYC) and Anti-Money Laundering (AML) checks. Dan Neidle, the founder of Tax Policy Associates who alerted the agency to the flaw, described the situation as "absolutely insane." He noted that the ease of access meant that no specialized hacking skills were required to potentially hijack a company’s identity. By changing a registered office address or filing fraudulent accounts, bad actors could effectively seize control of a business’s legal persona, intercepting sensitive correspondence or damaging its credit rating.

“

For a registrar that holds the records of millions of businesses, including global giants like AstraZeneca, Shell, and Tesco, the integrity of its data is paramount.

This incident occurs at a particularly sensitive time for Companies House. Under the Economic Crime and Corporate Transparency Act 2023, the agency has been transitioning from a passive recipient of information to an active regulator with enhanced powers to verify the identity of directors and challenge suspicious filings. This breach undermines the agency's new mandate. If the "source of truth" for UK corporate data cannot secure its own interface against basic navigational errors, the legal and RegTech sectors may question the reliability of the broader digital transformation efforts currently underway. For legal professionals and RegTech providers who rely on Companies House APIs for due diligence and automated filings, this service interruption creates an immediate operational vacuum.