A recent Companies House security issue has raised important questions about the reliability of UK corporate data and the growing risk of fraud linked to public registries.
While not a traditional cyber attack, the vulnerability exposed weaknesses in how company information is accessed and managed, highlighting that even official sources can be open to manipulation.
For businesses, legal professionals and insolvency practitioners, the implications extend beyond data exposure. This incident underscores a broader concern: how much trust can be placed in Companies House data without independent verification?
What happened
The issue stemmed from a flaw within the Companies House WebFiling system, introduced during a system update in late 2025. The vulnerability allowed users to access company records that were not their own, in some cases through simple navigation actions.
As a result, sensitive director information, including dates of birth, residential addresses and contact details, may have been exposed.
More significantly, there were concerns that unauthorised filings could have been made, including:
- Changes to director details
- Amendments to registered office addresses
- Submission of company filings
While there is no confirmed evidence of widespread abuse, the fact that the vulnerability existed for months has led to concerns around Companies House data reliability and potential misuse.
Why this matters for businesses
Increased corporate fraud risk
Companies House is widely used as a trusted data source by banks, lenders, counterparties and legal professionals. A weakness in this system creates opportunities for corporate fraud in the UK, particularly where bad actors exploit inaccurate or manipulated records.
This could include:
- Impersonating legitimate companies
- Opening bank accounts fraudulently
- Diverting payments or correspondence
This form of corporate identity fraud is becoming increasingly sophisticated, particularly where verification processes rely heavily on registry data alone.
Director data exposure and targeted attacks
The exposure of personal data significantly increases the risk of:
- Identity theft
- Phishing and spear-phishing attacks
- Social engineering targeting directors and senior individuals
Directors are often key decision makers with access to financial controls, making them high-value targets. The availability of this data through a Companies House vulnerability lowers the barrier for targeted fraud.
Reliability of Companies House data
For legal professionals and insolvency practitioners, this incident raises a critical issue: can Companies House be treated as a single source of truth?
In practice, reliance on unverified registry data can introduce risk into:
- Due diligence processes
- Corporate investigations
- Asset tracing exercises
- Litigation and insolvency proceedings
Where company records may be inaccurate or temporarily manipulated, decisions based solely on this data may be flawed.
How could this have been prevented?
The vulnerability appears to have been the result of system design and control failures, rather than a sophisticated external breach. Several preventative measures could have reduced the risk:
Stronger access controls
Proper segregation of user permissions should prevent any possibility of accessing another company’s records without authorisation.
Robust testing and QA processes
The flaw was introduced during a system update and remained undetected, suggesting insufficient penetration testing and user validation.
Layered security approach
Over-reliance on single authentication methods (such as filing codes) creates risk. An in-depth defence approach, combining multiple verification layers, would significantly reduce exposure.
Continuous monitoring and alerts
Effective systems should detect:
- Unusual access patterns
- Irregular filing activity
- Cross-account access attempts
The absence of such controls allowed the issue to persist longer than it should have.
What should companies do now?
In light of this Companies House security issue, businesses should take proactive steps to mitigate risk:
- Review company records for any unauthorised changes
- Monitor filing history and updates regularly
- Restrict internal access to filing credentials
- Educate directors on fraud and phishing risks
- Conduct enhanced due diligence on counterparties
Taking these steps can reduce exposure to company filing fraud and improve overall resilience.
The role of corporate investigations and due diligence
This incident highlights a key point: public registry data should not be relied upon in isolation.
At ESA Risk, we support clients with:
- Independent verification of company information
- Identification of discrepancies in filings
- Corporate investigations into ownership and control
- Due diligence on business partners and counterparties
- Fraud risk assessment and ongoing monitoring
Where there is uncertainty around data integrity, independent intelligence provides clarity and reduces risk.
A wider issue for UK corporate transparency
The UK has taken steps to strengthen corporate transparency through legislative reform. However, this incident demonstrates that data availability must be matched by data security.
As Companies House becomes more central to fraud prevention efforts, its reliability and resilience are increasingly critical. For businesses and advisors, this means adopting a more cautious and investigative approach to corporate data.
Key takeaways for businesses and advisors
The Companies House vulnerability is a timely reminder that even official systems are not immune to risk.
For businesses, the threat lies in fraud, impersonation and data misuse. For legal and financial professionals, it highlights the importance of verifying information beyond surface-level records.
In an environment where corporate fraud risk in the UK continues to evolve, relying solely on publicly available data is no longer sufficient.
Independent verification, proactive monitoring and informed investigation are now essential components of effective risk management.
Speak to ESA Risk today
If you have concerns around the accuracy of Companies House data or potential exposure to corporate fraud, ESA Risk can assist. We support businesses, legal professionals and insolvency practitioners with discreet, intelligence-led enquiries to verify company information and identify risk.
Whether you require straightforward verification of company records or more in-depth investigations into ownership, control or suspected manipulation, we will work with you to understand your objectives and tailor our approach accordingly.
Where there is uncertainty around filings or director information, we can also undertake tracing, due diligence and background enquiries to ensure you are relying on accurate, up-to-date intelligence.
Contact our Client Services team at advice@esarisk.com, on +44 (0)343 515 8686 or via our contact form.
