Companies House Suspends WebFiling After Critical Data Exposure Glitch

The suspension of the UK’s Companies House WebFiling service marks a significant failure in the digital infrastructure of one of the world’s most critical corporate registries. The vulnerability, characterized by tax expert Dan Neidle as "absolutely insane," allowed users to bypass standard authentication barriers simply by using a browser's back button. This glitch was not a sophisticated cyberattack but a fundamental breakdown in session management, exposing sensitive personal data of directors across the UK’s corporate landscape, including those at FTSE 100 giants like Shell, AstraZeneca, and Tesco.

The technical nature of the flaw—whereby a user could navigate into the dashboard of a different entity—suggests a failure in how the WebFiling platform handled state and session tokens. In modern web architecture, such session-management or Insecure Direct Object Reference (IDOR) vulnerabilities are considered elementary security oversights. For a government agency tasked with maintaining the integrity of the UK's business environment, the exposure of home addresses, dates of birth, and email addresses provides a potential gold mine for identity thieves and fraudsters.

“

For major corporations like AstraZeneca or Shell, the potential for corporate hijacking, however brief, necessitates an immediate and thorough forensic audit of all filings made during the period the vulnerability was live.

The implications extend far beyond simple data privacy. As Neidle pointed out, the ability to not only view but edit data is the most alarming aspect. Fraudsters could theoretically change a company’s registered office address to a location under their control. Once the address is changed, they could intercept official correspondence, apply for credit in the company’s name, or even attempt to file fraudulent accounts to manipulate market perceptions or facilitate money laundering. For major corporations like AstraZeneca or Shell, the potential for corporate hijacking, however brief, necessitates an immediate and thorough forensic audit of all filings made during the period the vulnerability was live.