Ormerod Rutter has been made aware about a security issue affecting Companies House’s WebFiling service. You may also have had an email about this directly from Companies House.
We want to reassure our clients and set out clearly what has happened, and what action you may need to take.
This is a Companies House issue
This security vulnerability was entirely within Companies House’s own systems and has no connection to Ormerod Rutter, or any systems we use on your behalf.
It’s important to note that Companies House do not believe this to be a malicious cyber-attack, and state that no data breaches have currently been identified.
What happened?
On Friday 13th March, Companies House was made aware of a security issue which meant that a logged-in user of their WebFiling service could potentially access and change some elements of another company’s details without consent, after performing a specific set of actions. This was not accessible to the general public, only users with an authorisation code who were already logged in to the service could have performed this action.
Affected data may have included directors’ dates of birth, residential addresses, and company email addresses, as well as the possibility of unauthorised filings.
Companies House’s investigation indicates that the issue was introduced when their WebFiling systems were updated in October 2025. It therefore went undetected for approximately five months before being identified.
What has Companies House done?
The WebFiling service was closed at 1:30pm on Friday 13th March while the issue was investigated and resolved. It has been independently tested and was back online as of 9am on Monday 16th March.
Companies House has proactively reported this incident to the Information Commissioner’s Office (ICO) and the National Cyber Security Centre (NCSC).
As of the latest update, there are no reports of data having been accessed or changed without permission, though the investigation remains ongoing.
What should you do?
Companies House is contacting every company’s registered email address between Tuesday 17th March and Thursday 19th March to explain what happened, how to check details, and what steps to take if there are any concerns.
If you have a concern, contact Companies House directly at enquiries@companieshouse.gov.uk using ‘WebFiling issue’ in the subject heading, and include evidence to describe the concern
Where to find official information
For the most up-to-date information, we direct all clients to the official GOV.UK statement: gov.uk/government/news/update-on-companies-house-webfiling-security-issue
If you have any questions or would like to talk through what this means for your company, please don’t hesitate to get in touch with us.
