Companies House WebFiling Security Issue: Director’s Legal Action Checklist

Key Takeaways

1. The Companies House WebFiling security issue has put sensitive director and PSC (Person with Significant Control) data at risk, exposing thousands of UK startups and SMEs to regulatory, legal, and reputational issues.
2. Delay or failure to act following a data breach can result in regulatory fines from the ICO and Companies House—and may lead to directors being held personally liable.
3. Directors must undertake a prompt, structured security audit and follow a step-by-step breach response checklist to comply with GDPR and Companies Act 2006 obligations.
4. Rapid notification to the Information Commissioner’s Office (ICO) is crucial if personal or company data was compromised in the Companies House breach.
5. Transparent, factual communication with shareholders, board members, and PSCs demonstrates good governance and builds trust during a crisis.
6. Overlooking essential clauses in your incident response—especially regarding notification, documentation, and remedial actions—can lead to further liability or enforcement by regulatory bodies.
7. Go-Legal AI provides director-friendly tools to assess your legal position, generate breach response letters, and build robust defences against future Companies House security flaws.
8. Directors are legally responsible for ensuring account security: regularly review user access, enable strong authentication, and monitor filing activity to future-proof your company.
9. Go-Legal AI is rated Excellent on Trustpilot with over 170 five-star reviews from UK business owners.
10. Using unverified legal templates or ignoring expert support after a breach can lead to disputes, financial losses, and an inadequate response in the eyes of authorities or regulators.

What Legal Steps Should Directors Take After the Companies House WebFiling Security Issue?

Was your company’s sensitive director data exposed by the recent Companies House WebFiling security flaw? Many directors and PSCs in the UK are urgently seeking practical guidance. Delays or mistakes now could result in ICO fines, shareholder claims, or even personal director liability under the Companies Act 2006 and Data Protection Act 2018.

Directors must act quickly: audit your company’s filings for unauthorised activity, document your findings, notify required authorities, and communicate transparently with stakeholders. This clear guide shows you every step—from immediate risk checks to drafting board notifications and securing your company against further threats.

Go-Legal AI’s tailored tools make it easy to self-audit, access expert-reviewed breach templates, and ensure compliance—supporting you to protect your business and fulfil your legal obligations in response to a Companies House security breach.

What Is the Companies House WebFiling Security Issue and Who Is at Risk?

The Companies House WebFiling security issue refers to a major vulnerability in the UK government’s online system, used for submitting company filings. Between October 2025 and March 2026, a flaw exposed director and company information to unauthorised individuals. This issue affected every company, LLP, and CIC using the WebFiling service during this period, regardless of size or sector.

Directors are at particular risk because sensitive personal details—such as home addresses, dates of birth, and directorship history—could have been accessed. The main dangers include identity theft, fraudulent directorship changes, loss of corporate control, or financial crime.

If your company or LLP used WebFiling during these dates, you should treat your data and filings as potentially compromised until a full review is complete.

What Data Was Exposed in the Companies House WebFiling Breach?

Here is a breakdown of the types of data involved in the Companies House security issue:

What Legal Duties Do Directors Have After a Companies House Security Issue?

Under the Companies Act 2006 (particularly s.172), directors have a duty to act in the best interests of the company and its shareholders—this includes taking rapid action if data or corporate authority is compromised. Proper records must be kept, and any unauthorised or fraudulent filings must be reported immediately.

As data controllers under GDPR and the Data Protection Act 2018, directors are also legally responsible for the personal information their company holds. If the breach creates risks for individuals (such as possible identity theft), you must assess and document it promptly, then report it to the ICO if warranted. Failing to act—or acting haphazardly—can result in substantial penalties, shareholder actions, or director disqualification.

Firms listed on the LSE or regulated by the FCA must also consider disclosure duties to the market and ensure that PSCs and the board are kept up to date.

How to Check if Your Company Was Affected by the Companies House WebFiling Security Flaw

Directors should immediately assess whether their company was impacted by following these steps:

1. Log in to Companies House WebFiling: Access your company profile using official credentials.
2. Review the Filing History: Carefully examine every filing made between October 2025 and March 2026.
3. Spot Unauthorised Filings: Look for unexpected appointments, resignations, address or PSC changes.
4. Scrutinise Companies House Emails: Review all service notifications from the relevant period for missed alerts.
5. Document All Findings: Log every suspicious finding and note names/times.
6. Request Audit Logs: Ask Companies House for an official audit trail of account activity if needed.
7. Update the Board and Key Stakeholders: Provide a clear summary of your review and the next steps.

Use our AI-powered checklist tool to generate a detailed breach audit report for your files.

Step-by-Step Director’s Checklist for Companies House Security Breach Response

A clear incident response ensures compliance and minimises damage. Directors should:

1. Confirm All Filings: Identify any unauthorised actions in your company’s records.
2. Remove Rogue Access: Immediately revoke access for unknown or unauthorised users.
3. Strengthen Account Security: Change all passwords and turn on two-factor authentication.
4. Notify Board & PSCs: Provide prompt updates to all directors and Persons of Significant Control.
5. Check Linked Services: Ensure no unexpected changes to company bank accounts, HMRC records, or payroll.
6. Log Every Action: Keep detailed, dated notes of all findings and communications.
7. Report to Companies House and, if required, the ICO: Make required notifications promptly.
8. Prepare Notifications: Draft clear and factual notices for affected directors and stakeholders.
9. Audit Processes: Identify why the breach occurred and address vulnerabilities.
10. Update Policies: Revise your data and incident management procedures.

How to Notify the ICO and Meet GDPR Breach Reporting Requirements

Directors must follow GDPR reporting rules if personal data risk is likely. Here’s how to comply:

1. Risk Assessment: Decide whether the breach could lead to harm or distress (such as identity theft).
2. Document Your Decision: Record your rationale whether you notify the ICO or not.
3. Notify the ICO Online: Use the ICO’s breach notification portal within 72 hours.
4. Include in Your Report:
   • Nature and scope of the breach
   • Data types and number of individuals affected
   • Real or potential consequences (e.g., ID fraud)
   • Steps taken to contain or remedy the breach
   • Contact details for your DPO or main point of contact
5. Notify Data Subjects: Where there is high risk, contact affected parties promptly, using plain English.
6. Keep Complete Records: Retain all reports, internal emails, and documents related to the breach.

Breach Notification Template Example:
“On [Date], we identified a vulnerability in Companies House WebFiling which may have led to unauthorised access to director addresses and contacts. We have secured our records, notified the ICO, and are keeping all authorities updated. No passwords or financial data were involved.”

Key Clauses to Include in Your Data Breach Incident Response Plan

A comprehensive incident response plan not only limits exposure but enhances board accountability and compliance. Key elements include:

How to Communicate the WebFiling Breach to Shareholders, PSCs, and Board Members

Effective stakeholder communication is vital under both company law and GDPR. Directors must give prompt, factual updates to the board, PSCs, and (if appropriate) shareholders, to demonstrate transparency and maintain trust.

• What to Include:
  • A brief summary of events, which data was affected, and current next steps.
  • Avoid speculation—use only confirmed facts.
  • Details of your main contact for queries.
• When to Notify:
  • Inform the board and PSCs as soon as a credible threat or unauthorised action is confirmed.
  • Notify shareholders early if the breach affects them or creates regulatory exposure (especially for PLCs or FCA-authorised firms).
• How to Communicate:
  • Use clear, precise language.
  • Offer reassurance and explain your action plan.
  • Keep written records (email, board minutes) of every communication and response.

Future-Proofing Companies House Account Security: Best Practices for Directors and SMEs

Preventing future incidents is a core director responsibility. Implement these measures as standard:

• Enable Multi-factor Authentication (MFA): Require 2-step login for all users.
• Restrict User Permissions: Only allow essential staff to submit filings.
• Quarterly Access Reviews: Regularly check and update user access lists.
• Monitor Filing Changes: Use automated email alerts for any new or edited Companies House filings.
• Ongoing Staff Training: Regularly update your team on current risks, phishing trends, and response channels.

Use our real-time audit and monitoring checklist to systematise your security reviews.

How Go-Legal AI Simplifies Companies House WebFiling Security Issues

Go-Legal AI’s intelligent platform is designed for directors and business leaders who need rapid, reliable legal support—especially in high-risk incidents involving Companies House or data security. With Go-Legal AI, you can:

• Access instant, step-by-step breach response guides.
• Generate ICO-compliant notifications and board-ready incident reports in minutes.
• Run automated security checks to flag suspicious WebFiling activity.
• Confirm your director duties under the Companies Act and Data Protection Act, tailored to your situation.
• Access stakeholder communication templates in plain English, for every audience.

Our tools transform the way non-lawyers handle legal risk, empowering you to resolve issues and demonstrate best practice—without overwhelming complexity or cost.

Frequently Asked Questions

What should I do first if I suspect my company was impacted by the Companies House WebFiling security issue?

Immediately sign in to Companies House WebFiling, check your company’s recent filing history for unexpected or unauthorised changes, and make clear notes of your findings. Update the board and use our checklist generator for a fully compliant response.

Do I have to notify the Information Commissioner’s Office (ICO) if my directors’ data was visible?

You must notify the ICO within 72 hours if the breach poses a risk to the privacy, finances, or well-being of the individuals affected. If in doubt, it is safer to report and evidence your decision using our notification template.

What kinds of directorship data were exposed in this breach?

Potentially, director home addresses, emails, and dates of birth were exposed. Account passwords, identity documents, and older company filings were not included in this incident.

Could directors or the company face fines if the breach isn’t handled correctly?

Yes. Non-compliance with Companies Act and GDPR duties can result in personal liability for directors, significant fines, and potential disqualification. Acting swiftly and documenting every step significantly reduces exposure.

How can I make sure my company doesn’t fall victim to this kind of breach again?

Set up multi-factor authentication, review WebFiling user access quarterly, monitor for filing changes, and ensure staff understand cyber risks. Our audit and monitoring checklists make this process fast and transparent.

Where can I get templates or a full incident response plan?

Generate breach response checklists, stakeholder notification templates, and a comprehensive incident response guide instantly using our AI-powered template builder.

Safeguard Your Company Against Companies House Security Risks

Understanding and addressing the Companies House WebFiling security issue is essential for every director aiming to protect their company, its data, and their own legal position. By acting quickly—auditing your filings, following a step-by-step incident checklist, and communicating promptly with stakeholders—you safeguard against personal liability, regulatory fines, and business disruption. Neglecting these steps risks unauthorised filings, data misuse, reputational harm, and possible enforcement by Companies House or the ICO.

With Go-Legal AI, you have access to director-friendly breach response checklists, ready-to-use ICO notification templates, detailed audit guides, and legally validated tools for every scenario. Take charge of your company’s future security—secure your accounts, meet all compliance demands, and demonstrate best practice corporate governance.

Protect your business with a platform built for real-world company directors. Try our comprehensive free trial to see how easy legal compliance and incident response can be.