2026 Companies House — WebFiling back-button vulnerability
Data compromised
Directors' addresses, emails, dates of birth
Technical writeup
UK Companies House discovered a critical vulnerability in its WebFiling platform March 12-13, 2026. A back-button exploit allowed logged-in users to bypass authentication and access any of 5 million companies' private dashboards. Exposed: directors' home addresses, email addresses, full dates of birth. Flaw introduced October 2025; live 5-6 months. Vulnerability could enable company hijacking and fraudulent filings. WebFiling service suspended; fixed and restored.
Root cause
Back-button authentication bypass; WebFiling vulnerability