A Companies House blunder has raised concerns after a flaw in the WebFiling service briefly exposed sensitive company data. The issue, identified on 13 March 2026, meant that a logged-in user could potentially access and amend limited details of another company by carrying out a specific sequence of actions.

Companies House has stated that this system vulnerability was not available to the general public. Only users with authorised access codes who were already logged into the system could have exploited it. Nevertheless, the nature of the flaw meant that certain private information, such as dates of birth, residential addresses and company email addresses may have been visible. There was also a risk that unauthorised filings, including accounts and changes to director details, could have been submitted on another company’s record.

After identifying this issue, Companies House shut down the WebFiling service at 13:30 on 13 March to investigate. Following independent testing, the system was restored at 09:00 on 16 March. Companies House has said that passwords and identity verification data were not compromised, and that existing filed documents, such as accounts or confirmation statements, could not be altered.

The issue is believed to have arisen from a WebFiling systems update in October 2025. It has been reported to both the Information Commissioner’s Office and the National Cyber Security Centre.

Companies are now being urged to review their registered details and filing history carefully. While no confirmed misuse has been reported so far, Companies House is continuing to investigate. If a company has a concern, it should raise a complaint via the Companies House complaints page at www.gov.uk/government/organisations/companies-house/about/complaints-procedure and include evidence to describe the issue.

Bona vacantia is Latin term meaning “ownerless goods”. The bodies that deal with bona vacantia claims vary across the United Kingdom, but they all ultimately represent the Crown.

Under company law, when a company is dissolved, any remaining rights or property automatically pass to the Crown as bona vacantia. This includes valid rights such as a tax refund from HMRC. However, if the company never had a genuine legal entitlement, for example, because a claim was fraudulent, then no right existed in the first place and nothing passes as bona vacantia.

It is important to note that only formally dissolved companies are affected by bona vacantia. A company that is “in liquidation” or “being wound up” is in the process of closure but still legally exists. Until dissolution takes place, the company’s property and rights remain vested in the company.

In some circumstances, a company may apply to be restored to the register if it was dissolved less than six years ago. If restoration is successful, any property previously treated as bona vacantia revests in the company as though it had never been dissolved. However, restoration can be a very complex and costly process. For that reason, directors should ensure that all assets, including potential tax refunds, are properly addressed before a company is dissolved.

A person with significant control (PSC) is someone who owns or exercises significant influence over a company. They can also be referred to as a “beneficial owner”.

Every UK company is required to identify its PSCs and register their details with Companies House. A company can have one or more PSCs.

A PSC is someone who meets one or more of the “nature of control” conditions.

A PSC is usually anyone who:

• has more than 25% shares or voting rights in your company
• can appoint or remove a majority of directors
• can influence or control your company or trust

Companies should review their register of members as well as their constitution and articles of association to help determine who meets these criteria.

When incorporating a company, and whenever PSC details change, the required information must be filed with Companies House within 14 days of confirmation. Required details include the PSC’s name, date of birth, nationality, correspondence or service address, level of shareholding and the date they became a PSC.

PSCs must also verify their identity and provide a personal code. Failing to provide accurate information, or refusing to respond to formal notices, is a criminal offence.

Did you know you can monitor any UK company for free and get email alerts when key details change, which can help protect your own business from unexpected or unauthorised filings?

A significant amount of information about companies is available in the public domain from Companies House. Companies House is responsible for incorporating and dissolving limited companies, examining and maintaining statutory records, and making company information publicly accessible.

Much of this information is available free of charge, in line with the government’s commitment to open data. As a result, all publicly available digital information held on the UK register of companies can be accessed without cost.

The information available includes core company details such as the registered address and date of incorporation, details of current and resigned directors and officers, copies of documents filed with Companies House, mortgage and charge information, previous company names and insolvency records.

In addition, you can choose to monitor a company and receive email alerts whenever new documents are filed, such as changes to directors or registered office addresses. This can also be a useful safeguard for your own company, helping you to identify any unexpected or unauthorised filings at an early stage.

A Company Voluntary Arrangement (also known as a CVA) is a special arrangement that allows a company with debt problems or that is insolvent to reach a voluntary agreement to pay its business creditors over a fixed period of time.

The arrangement is similar to the Individual Voluntary Arrangement (IVA) that can be used by a sole-trader or self-employed person who is unable to pay their debts.

An application for a CVA can only be made with the agreement of all directors of the company in question or all of the partners of a limited liability partnership (LLP). A CVA can only be created by using the services of an insolvency practitioner. They will be responsible for set up and administration of the arrangement.

Once an insolvency practitioner has been appointed the following steps will take place:

1. The insolvency practitioner will work out an ‘arrangement’ covering the amount of debt the company can pay and a payment schedule. They must do this within a month of being appointed.
2. The insolvency practitioner will write to creditors about the arrangement and invite them to vote on it.
3. A CVA must be approved by creditors representing at least 75% of the debt value of those who vote (rather than 75% of the total overall debt).

If the agreement is approved and the company does not meet the terms of the CVA then any of the creditors can apply to have the business wound up.