Companies House has started emailing every company’s registered address this week to set out what happened with the WebFiling security issue and what to do next. The message is going out between Tuesday 17 March and Thursday 19 March, following an incident identified on Friday 13 March 2026. The agency says this is a precaution to help businesses verify their records promptly. (gov.uk)

In a statement published on Monday 16 March, chief executive Andy King said a logged‑in WebFiling user could, after a specific series of actions, potentially view limited non‑public details for another company and even attempt unauthorised changes. WebFiling was taken offline at 1:30pm on Friday 13 March and restored at 9:00am on Monday 16 March after independent testing. (gov.uk)

Crucially, Companies House stresses this was not a cyber‑attack. The issue stemmed from a WebFiling update made in October 2025 and could only be triggered by a logged‑in user; it was not exposed to the general public. Officials add that passwords were not compromised, identity‑verification data (including passport details and personal codes) was not accessed, and existing filed documents could not be altered. (gov.uk)

The agency’s email explains what might have been visible: the day element of dates of birth, residential addresses for directors and PSCs, and a company’s registered email address. While Companies House believes large‑scale data extraction was not feasible, it is asking all firms to check their registered details and filing history now, and to flag anything unexpected. (gov.uk)

For finance teams, accountants and company secretaries, this is an operational hygiene exercise that should not wait for quarter‑end. Log into WebFiling and cross‑check what you see there against your internal board minutes and recent submissions on the public ‘Find and update company information’ service. If something looks off, email enquiries@companieshouse.gov.uk with ‘WebFiling issue’ in the subject, including your company name and number to speed triage. (gov.uk)

Companies House also nudges firms towards its free Follow service, which sends instant alerts whenever a filing appears against a chosen company. For SMEs without a formal company secretarial function, this is a low‑effort early‑warning system that helps catch rogue changes to directors or addresses before they snowball into banking or supplier problems. (gov.uk)

Regulatory steps are in motion. Companies House says it has reported the incident to the Information Commissioner’s Office and notified the National Cyber Security Centre, and will take firm action if evidence emerges of unauthorised access or changes. As of publication, the agency says it has no confirmed reports of misuse, but analysis continues. (gov.uk)

Some readers will ask why they cannot unsubscribe from this week’s email. Since March 2024, every company must provide a registered email address for official contact, and Companies House confirms that address will not appear on the public register; you also cannot opt out of legal notices sent to it. That’s by design to ensure the registrar can reach firms quickly when issues arise. (gov.uk)

A quick fraud reminder as inboxes fill up: genuine Companies House messages come from ‘.gov.uk’ addresses. If anything looks suspicious, the government’s own guidance advises not to click links, report it to phishing@companieshouse.gov.uk, and delete it. Treat unexpected ‘verification’ or ‘payment’ prompts with extra caution. (gov.uk)

Context matters here. WebFiling sign‑in moved to GOV.UK One Login with two‑factor authentication from 13 October 2025 to tighten account security, and Companies House now says the October 2025 system update is when this specific issue was introduced. The timing underscores that even security upgrades can create new operational risks that need swift remediation. (gov.uk)

Near‑term planning still matters. The joint online filing service for accounts and Company Tax Returns closes on 31 March 2026, so finance teams should already be switching to approved alternatives. With filing routes changing and vigilance high after last week’s incident, building a 30‑minute monthly register check into BAU feels like time well spent. (gov.uk)