Companies House Security Breach 2026: Directors’ Action Guide

Key Takeaways

1. The Companies House security breach 2026 may have exposed director and company data, increasing risks of identity fraud and unauthorised filings.
2. Delayed action after a Companies House data breach can result in significant losses, contractual disputes, or permanent fraudulent changes on your company record.
3. Under GDPR, UK directors must notify affected parties and assess whether reporting to the Information Commissioner’s Office (ICO) is required when personal data is at risk.
4. Regularly review your Companies House records for unauthorised changes to director details or authentication codes and act immediately to reverse fraudulent amendments.
5. Timely rectification of false filings and robust security updates are crucial for compliance with the Companies Act 2006.
6. Go-Legal AI provides step-by-step digital workflows and tools to support directors in managing compliance and safeguarding business data after a Companies House data breach.
7. Go-Legal AI is rated Excellent on Trustpilot with over 170 five-star reviews from UK business clients.

What Should Directors Do After the Companies House Security Breach 2026?

If you are concerned your business was impacted by the 2026 Companies House security breach, you are not alone. After millions of company records and director details were exposed, identity fraud and unauthorised access became urgent threats.

This step-by-step guide outlines how to check if your business was affected, your legal obligations under the Companies Act 2006 and GDPR, and how to report or remedy unauthorised company filings. You will learn to reduce future risk and protect your company’s status and data fast.

Let our expert tools guide you through the process—our platform enables directors to check for breaches, rectify records, and maintain compliance in minutes.

What Happened in the Companies House Security Breach 2026?

This breach highlighted a key weakness: electronic filings at Companies House are legally binding and could be manipulated to change company ownership or banking rights within hours.

How to Check if Your Company Was Affected by the Companies House Data Breach

To verify whether your business was impacted by the Companies House security breach:

1. Check Official Communications: Review emails and correspondence from Companies House about the breach or changes to your records.
2. Search the Companies House Register: Input your company name on the Companies House website and review recent filings for anything unfamiliar.
3. Inspect Your WebFiling Account: Log in directly. Confirm your authentication codes, director and shareholder details are correct, and check backdated submissions.
4. Monitor for Alerts: Watch for notifications about code resets or address changes. Any unexpected alerts could signal unauthorised activity.
5. Leverage Automated Tools: Our instant breach checker scans your Company Number for red flags such as new directors, filings, or changes since the breach.

Directors’ Immediate 24-Hour Action Checklist After a Companies House Security Breach

Action Checklist (First 24 Hours):

1. Access and Audit Your WebFiling Account
   • Log in; review every new or changed filing.
   • Look for new directors, address changes, or document uploads out of sequence.
2. Change Your Authentication Code
   • Request a new code from Companies House immediately.
   • Introduce a rule: never share codes by email or WhatsApp.
3. Notify All Directors and Company Secretary
   • Circulate breach details and align your rapid company response.
4. Flag Suspicious Entries at Companies House
   • Use the “Report It” tool or call the Companies House fraud line.
5. Alert Bank and Key Suppliers
   • Banks and suppliers may rely on Companies House for due diligence. Advise them of the issue so they can halt changes to accounts or credits.
6. Consider GDPR and ICO Notifications
   • If personal data was exposed, conduct an immediate assessment for ICO reporting obligations. Our platform provides a GDPR breach reporting template built for directors.
7. Inform Stakeholders
   • If any company data with regulatory or ownership value was affected, inform staff, investors, or partners.
8. Record All Actions
   • Maintain a log of events, with all evidence and correspondence.

Legal Duties for Directors: GDPR, ICO Reporting, and Companies Act 2006 Explained

• GDPR/Data Protection Act 2018: As controllers of personal data, directors must review the impact of any breach. If data such as names, addresses, or dates of birth were accessed and this could lead to harm, notify the ICO within 72 hours using their online portal.
• ICO Reporting: Any breach involving risk to data subjects’ rights (including identity theft, or financial fraud) requires urgent online notification. Preserve all assessment and reporting records.
• Companies Act 2006:
  • Directors must keep company records “accurate and up to date.”
  • Directors have a legal responsibility to prevent or promptly undo false public statements or fraudulent filings.
  • Use Companies House forms RP02A (rectifying unauthorised filings) and RP08 (removing director addresses) without delay.

Key Steps to Report, Rectify, and Prevent Unauthorised Filings on Companies House

Steps to follow if your company was affected:

1. Report Directly to Companies House
   • Email fraud@companieshouse.gov.uk, use the online fraud tool, or call their emergency fraud line to flag unauthorised activity.
2. File Rectification Forms
   • Use RP02A for removing unauthorised filings or RP07/RP08 if addresses or director data have been abused.
   • Enclose proof of your directorship and evidence that changes were unauthorised.
3. Monitor Filing History
   • Re-examine filings every 24 hours for new or recurring unauthorised actions.
4. Reset All Authentication Codes
   • After the initial breach, ensure codes are complex, unique, and never distributed by insecure means.
5. Update Security Practices Internally
   • Limit code access to current directors/officers.
   • Provide briefings to all relevant staff and advisers.
6. Inform Bank and Stakeholders
   • Notify your business bank and major partners, confirming that records have been rectified to avert any mistaken transactions.
7. Leverage Our Step-by-Step Digital Workflow
   • Follow our guided rectification process and template forms for a compliant Companies House remedy—saving you hours and reducing legal risk.

Document Checklist: What Directors Must Review and Update After a Security Breach

Use our secure document review tool to compare your current Companies House records to historical filings in just a few clicks.

How to Protect Your Company Against Future Companies House Security Vulnerabilities

To protect your company, implement these practices:

• Use Complex, Rotating Authentication Codes: Never share codes by email or messaging apps. Set fixed rotation intervals.
• Restrict Portal Access: Only current directors and trusted officers should have login access.
• Set Up Filing Alerts: Companies House offers email alerts for every filing—enable them for all directors.
• Maintain Offline Company Registers: Save regular, dated backups and off-register logs to help identify any change rapidly.
• Review Monthly: Schedule quick compliance reviews using our templates to catch problems early.
• Educate Your Team: Make sure everyone who handles filings understands basic security and fraud risks.
• Use Smart Legal Tech: Regularly leverage our breach monitoring, rectification workflows, and compliance alerts for ongoing protection.

Companies House Data Breach vs Other UK Corporate Cyber Risks: What Directors Need to Know

• Companies House breaches have immediate legal effect on control and authority over your business structure.
• General cyberattacks impact day-to-day running, reputation, and client trust—often requiring technical, as well as legal, emergency response.

How Go-Legal AI Simplifies Companies House Breach Response for Directors

With Go-Legal AI, you can:

• Instantly Check Your Exposure: Just enter your company name or number for a risk report.
• Auto-generate Notification Letters: Personalised, legally compliant templates for reaching Companies House, ICO, and key partners.
• Guided Rectification Steps: Custom workflows and digital form filling (RP02A, RP07, RP08), matched to your breach situation.
• Secure Document Review: Compare past and current records using our AI-driven checker for fast detection of unauthorised changes.
• Compliance Alerts: Receive reminders for all rectification and reporting deadlines.

Struggling to understand next steps? Our step-by-step tools and automated templates make breach response fast, accurate, and affordable.

Frequently Asked Questions

How do I find out if my director details are exposed from the Companies House breach?

Log into Companies House WebFiling and review all director details updated since June 2026. Any unfamiliar change should be investigated and, if unauthorised, reversed using correction forms and, if necessary, GDPR notification.

What should I do if my company authentication code was compromised?

Request a new code via Companies House at once. Inform all directors. Pause company filings until the new details are agreed and distributed securely. Monitor for repeat suspicious filings and consider a digital security audit using our platform.

Do I have to report the Companies House breach to the ICO?

If personal information such as director or shareholder names, addresses, or dates of birth were exposed with a risk of harm, GDPR requires ICO notification within 72 hours. Use the ICO’s online self-assessment tool and keep copies of your report.

Can I claim compensation if my information was exposed in the Companies House data breach?

Compensation is possible if you can prove harm (such as financial loss or distress). If you suffered a loss, contact your business insurer, log all evidence, and use our complaint template to begin your claim process.

How do I correct fraudulent changes made to my company records?

File the relevant rectification form (usually RP02A) with Companies House. Attach official ID and confirmation of your directorship along with details proving the changes were fraudulent. Escalate with the Companies House fraud team if the problem recurs.

Was my personal address or email accessed during the Companies House hack?

If you are a director or shareholder, carefully check the Companies House register and any recent correspondence. The breach primarily exposed address details, and in some cases, email—so review all filings and alerts for suspicious activity.

What steps can I take to prevent corporate identity theft?

• Carry out monthly checks of director/shareholder details.
• Use secure, complex authentication codes, rotating them regularly.
• Limit Companies House portal access to designated officers.
• Enable filing alerts for each new submission.
• Keep a secure, dated offline copy of all core company legal records.

What are my legal obligations after the 2026 Companies House breach?

Your obligations are to assess risk under GDPR (and notify the ICO if harm is likely), rectify incorrect public records, inform affected parties, and keep an internal breach audit of all actions and communications taken.

How quickly should directors act if they suspect unauthorised filings?

Act immediately. Unauthorised filings may become effective instantly and can be challenging to reverse if left unaddressed. Most successful corrections happen within the first 24 hours.

Are Companies House authentication codes still safe to use?

Yes, post-breach codes (from mid-2026) benefit from enhanced encryption and security policies. However, you should replace old codes, restrict distribution, and regularly audit your portal access logs.

Create Your Companies House Breach Action Plan with Go-Legal AI

With Go-Legal AI, you gain immediate access to:

• Automated risk scoring and exposure checks
• Customised ICO and Companies House notification templates
• Guided steps for all key forms (RP02A, RP07, RP08) and stakeholder communications
• Secure, ongoing document review for any future suspicious changes

Build your Companies House breach action plan—our expert templates and workflows deliver peace of mind and full, compliant legal protection.

Protect Your Business with a Companies House Breach Action Plan

The 2026 Companies House data breach proved how swiftly your company records and authority can be undermined by unauthorised online filings. You now have the tools and processes to detect, report, and reverse fraudulent amendments; rapid action will prevent identity theft, regulatory fines, and operational disruption.

Manual checks and generic forms are no longer enough. Our AI-driven breach checker, automated rectification templates, and compliance workflows put powerful legal protection at your fingertips—ensuring full control, fast remedy, and no costly delays.

Begin protecting your most valuable business asset today—sign up to build a personalised Companies House breach action plan in minutes, backed by expert templates and live step-by-step guidance.