Major glitch exposes personal director records for thousands
A critical security flaw has exposed confidential data, including residential addresses and phone numbers of directors at millions of UK firms. The issue was identified after a back button blunder allowed users to access rival company registers through the WebFiling service run by Companies House.
Key Points
-
1A critical 'back button' glitch on the WebFiling service operated by Companies House potentially allowed users to access confidential records from rival companies.
-
2The security issue, which has been active since October (year unspecified in text), exposed personal data including residential addresses of business directors across millions of UK firms and individuals.
-
3Companies House was forced to take the entire WebFiling platform offline for a weekend repair before bringing it back online on March 17th.
Developments
A technical glitch on the Companies House website potentially allowed logged-in users with authorized codes to view and edit other firms' personal data like home addresses. The chief executive apologized for the error but stated that while unauthorized access was possible in theory, there is no evidence it has been used systematically or by large volumes of people so far.
Companies House temporarily shut down its UK corporate registry's web filing service on March 13 due to security flaws allowing logged-in users potentially view or modify confidential data like personal addresses and company emails. The agency confirmed that while the vulnerability existed, passwords could not be accessed nor existing documents altered, with access limited individually rather than enabling large-scale systematic extraction of records.
Companies Home confirmed that its security flaw exposed the data (including home addresses) of five million companies from October 2025 to January, allowing logged-in users to view other company records one entry at a time. The vulnerability was discovered by Dan Neidle after failing contact with Ghost Mail's John Hewitt and required no additional authentication beyond logging into an account for the first purpose before navigating away via keyboard shortcuts.
A major vulnerability in Companies House's WebFiling system allowed unauthorized users to view private details like directors' residential addresses and alter company information by pressing the back key four times, though an internal investigation found no evidence of actual data access or changes without permission since it was discovered last Friday.