UK’s Companies House confirms security flaw exposed business data

Companies House discovered and remediated a logic flaw in its WebFiling system (introduced October 2025) that allowed logged-in users to access other companies’ dashboards and view unpublished personal/company data (including dates of birth, residential addresses and company emails) across up to five million records; the service was taken offline, patched, and the incident reported to the ICO and NCSC, with no confirmed reports of data being accessed or altered to date.