March 2026 Alert: Companies House Security Vulnerability

A significant security flaw in Companies House’s WebFiling system has exposed the confidential data of more than five million UK companies. The service was suspended in the afternoon of Friday 13th March 2026 and restored the morning of Monday 16th March 2026. Here’s what happened, who’s affected, and what you and your clients should do right now.

⚠ Bright systems are not affected: This vulnerability existed exclusively within Companies House’s own WebFiling platform. Bright’s software and our data exchange with Companies House are entirely unaffected. Filing through Bright products continues normally.

What happened

On Friday 13 March, Companies House suspended its WebFiling service after a critical security vulnerability was identified in its systems. The flaw — introduced during a WebFiling system update in October 2025 — allowed any logged-in user to access the private dashboard of any other company registered at Companies House, without needing that company’s authentication code.

The vulnerability was discovered by John Hewitt, operations director at registered office provider Ghost Mail, who subsequently shared his findings with tax campaigner Dan Neidle of Tax Policy Associates. After notifying Companies House, Neidle published a detailed account of the flaw, at which point Companies House confirmed it had shut down the WebFiling service pending investigation.

The service was independently tested and restored at 9am on Monday 16 March. Companies House has since reported itself to both the Information Commissioner’s Office (ICO) and the National Cyber Security Centre (NCSC).

• • COMPANIES AT RISK
    5 million+ UK registered companies

  • VULNERABILITY ACTIVE SINCE
    October 2025

  • SERVICE SUSPENDED
    1.30pm, Friday 13 March

  • SERVICE RESTORED
    9am, Monday 16 March

How the vulnerability worked

A simple back-button exploit

The flaw required no hacking tools or technical expertise — just a web browser and a Companies House login.

1. A user logs in to WebFiling using their own credentials and accesses their company’s dashboard normally.

2. They select “File for another company” and enter the company number of any of the five million companies on the register.

3. The system requests an authentication code — which they don’t have. Instead of stopping here, they press the browser’s “back” button several times.

4. Rather than returning to their own dashboard, the system displays the target company’s dashboard — without the authentication code ever being entered.

5. From here, the user could view private director data, change company details, or potentially submit filings on behalf of that company.

What data was at risk

Any company registered at Companies House may have had the following information exposed to unauthorised access:

1. Director names, residential addresses, email addresses, and full dates of birth (normally hidden from public view)

2. Company registered address and contact details

3. The ability to change company details, appoint or remove directors, or upload fraudulent accounts

Companies House has confirmed it has so far received no reports of any details that have been changed, and there is currently no evidence the vulnerability was exploited. However, the flaw appears to have been present since October 2025, and Companies House is still actively analysing its data for anomalies.

Are Bright’s systems affected?

No — Bright’s systems remain fully secure and operational

The vulnerability existed solely within Companies House’s own WebFiling platform. Bright’s software operates via a separate, independent data exchange with Companies House. There is no vulnerability in any Bright product, and all filing functionality — including through BrightPay, BrightTax, and our Companies House filing tools — is fully operational and unaffected.

What you should do now

Even with no confirmed exploitation, we recommend all accountants take proactive steps for themselves and their clients.

1. Check your company’s Companies House record
   Log in to WebFiling (now restored) and review your registered details, director information, and filing history. Look for any changes you didn’t authorise, particularly from October 2025 onwards.

2. Alert your clients
   Proactively contact clients — especially those with director-level responsibilities — and recommend they check their Companies House dashboards. Many will not yet be aware of this incident.

3. Look out for Companies House communications
   Companies House has confirmed it will email every registered company. Advise clients to watch for this official message and not to dismiss it as spam.

4. Report anything suspicious
   If you or a client identifies unauthorised changes, raise a formal complaint with Companies House immediately, including screenshots and dates as evidence.

5. Catch up on missed filings
   If a filing deadline was missed due to the WebFiling outage (Friday 13 – Monday 16 March), Companies House advises filing now. Capture screenshots of any error messages received during the outage period as evidence.

What Companies House is doing

Following discovery of the vulnerability, Companies House has taken the following steps:

1. Suspended WebFiling at 1.30pm on Friday 13 March

2. Independently tested and confirmed the fix, restoring the service at 9am on 16 March

3. Self-reported to the ICO and the NCSC under UK GDPR obligations

4. Actively analysing data for any signs of unauthorised access or changes

5. Committed to directly contacting any company identified as affected

Companies House CEO Andy King stated that the organisation takes its data responsibilities “extremely seriously” and committed to firm action if any unauthorised access is confirmed

The broader context: One Login concerns

This incident is not the first to raise questions about the security of the UK government’s digital identity infrastructure. One Login — the single sign-on system that Companies House made mandatory for WebFiling from October 2025 — has previously faced scrutiny following whistleblower allegations of critical structural vulnerabilities in the system. The current flaw, while separate from One Login, adds to a pattern of IT governance concerns that the accountancy profession will be watching closely.

This content may have been developed with the assistance of AI tools. Content is reviewed by a member of the Bright team before publication. Guidance on legislation can be obtained from your industry body.