Guidance

WebFiling issue: information and updates

Published 20 March 2026

What happened

Our investigation indicates that a defect was introduced when we updated our WebFiling systems on 11 October 2025 during a major system update.

It was not the result of any malicious attempt to breach its systems from outside or a cyber attack.

The defect could only have been exploited by an authenticated user (such as an officer of a company or an agent of a company) carrying out a specific sequence of actions, between 11 October 2025 and 13 March 2026.

WebFiling has been comprehensively tested and re-opened at 9am on Monday 16 March 2026.

At this stage, we have no confirmed reports of any data having been accessed without permission, and we believe the issue could not have been used to extract data in large volumes.

Our investigation is continuing and we’re committed to keeping our users updated as and when there’s new information to share.

Your data

Our investigation found that it was technically possible for a logged-in registered user to:

1. See certain data not normally published on the public register:

• the day of the date of birth for directors and people with significant control (PSCs) - usually only the month and year are visible on the public register
• residential address for directors and PSCs 
• company registered email address

2. File updates to any information without consent. For example, new accounts or changes of director.

We want to reassure you that:

• you do not need to reset your WebFiling password
• no identity verification data, such as passport information or personal codes, was accessed
• no existing filed documents could have been altered
• if you have applied to protect your personal details under the Companies Act 2006, your information was not affected by this issue
• there was no risk of bulk data transfer

Advice for companies

As a precaution, check your registered details and filing history to make sure everything looks correct. You can do this in WebFiling and on the Find and update company information service.

If anything seems incorrect or unexpected, email us with ‘WebFiling issue’ in the subject heading: enquiries@companieshouse.gov.uk 

Give as much detail as you can about your concern, including your company name and number. The more information you can give us to support our investigation, the easier it will be to resolve the issue for you.

Filing deadlines

If you missed your filing deadline because our WebFiling service was closed between Friday 13 March and Monday 16 March, you do not need to call us. File as soon as possible, and keep a record of the date and time you tried to access the service while it was closed.

The law requires us to apply a late filing penalty when a company files its accounts late. If you could not file your accounts or filed late because the service was closed, file your accounts as soon as possible and use our online service to appeal the penalty. Include any screenshots and timestamps from your filing attempts, and we’ll take this evidence into account.

Support offered to companies

We published a statement on Monday 16 March, shortly after reopening our WebFiling service at 9am.

We’ve sent emails to all companies using their registered email address, clarifying what’s happened and giving further recommendations for anyone who is concerned.

We’ve also shared this guidance across our channels.

In addition, our contact centre is on hand to support with any queries or concerns.

Our Follow service

We also recommend signing up to our free Follow service.

Follow sends you an instant email alert whenever a document is filed with us for any company you choose to follow, including your own. It’s a simple way to stay informed and spot anything unexpected as soon as it happens.

You can sign up through the Find and update company information service and then select ‘Follow this company’ on your company’s page.

Follow will not alert you to any changes that are not published on the public register. To see your own company’s private information, you’ll need to log in to your WebFiling account.

How we plan to prevent similar incidents

In addition to the rigorous testing before reopening the service on 16 March, we’re taking further actions to strengthen our services.

Although this was not a cyber attack, we’re continuing to strengthen our security across tools, policies, processes, systems, data and employee awareness in response to a more challenging threat environment. We’re investing in our security operations centre and other capabilities to mitigate these risks.

For the longer term, we’re committed to investing in our systems and technology to modernise our services and reduce risks associated with legacy technology. This work is an important part of our plan to prevent economic crime entering the system, protect companies and individuals from harm, and extend the value of the information within our registers as a key enabler of growth.

What we’re doing next

We’re conducting a detailed review of how the WebFiling defect happened and which processes we need to improve as a result.

We’re undertaking extensive analysis of system records to identify any suspicious activity. We have not identified any unauthorised changes, but we’re continuing to investigate. If we identify any unauthorised changes, we’ll work with companies to correct their record and take firm action against the person who made the filing.

We’re taking this matter very seriously. We’ll update this page when new information becomes available.