Loading story…
Companies House temporarily shut down its WebFiling service after a security flaw allowed logged-in users to view sensitive data belonging to other companies and potentially submit unauthorized filings on their behalf. The exposed information included directors’ dates of birth, residential addresses, and company email addresses, and the issue raised the possibility that changes to director details or company accounts could have been submitted to another company’s record while the flaw was active. The service was taken offline on 13 March and restored on 16 March after the issue was fixed and independently tested.
Companies House said the flaw affected data not normally published on the public register, but stated that passwords and identity documents such as passports were not exposed. The agency also said the issue was not believed to support large-scale or systematic extraction, with access limited to individual company records viewed one at a time by a registered WebFiling user. Reporting indicates the faulty behavior was introduced by platform changes made in October 2025, and the organization is reviewing whether any company records were altered and plans to contact affected firms if irregular activity is confirmed.
See attribution, scope, and your downstream exposure.
7 events from the most recent confirmed update back to the earliest known activity.
By 2026-04-03, reporting indicated Companies House was preparing an investment case to modernise legacy systems and strengthen identity checks following the WebFiling incident. Funding and implementation timelines had not yet been finalised.
On 16 March, Companies House publicly disclosed that the flaw may have exposed non-public company data and enabled unauthorized filings, while saying bulk extraction was unlikely. It advised companies to review their registered details and filing history as the investigation continued.
Companies House brought WebFiling back online at 9am on 16 March after remediating the flaw and completing independent testing. The agency said passwords, identity documents, and previously filed documents were not compromised or alterable.
During its response to the WebFiling incident, Companies House notified the Information Commissioner's Office and the National Cyber Security Centre. It also began reviewing whether any unauthorized access or record changes had occurred.
After the issue was publicized by tax professional Dan Neidle on 13 March, Companies House identified the problem and took the WebFiling service offline at 1:30pm that day. The agency began investigating and remediating the bug, which exposed data such as dates of birth, residential addresses, and company email addresses.
The flaw was discovered by John Hewitt of Ghost Mail before it became public. Reports indicate the issue was found in the week before Companies House took action.
Companies House said the WebFiling vulnerability appears to have been introduced during platform changes made in October 2025. The flaw could let an authenticated user with a valid company authentication code access limited non-public details from another company and potentially submit unauthorized filings.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
8 references tracked. Mallory keeps watching after this page renders.
meyka.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourceitpro.com
Open sourcehelpnetsecurity.com
Open sourcehackread.com
Open sourcego.theregister.com
Open sourcegov.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
France’s Ministry of the Economy and Finance confirmed a cyber intrusion into the **Direction générale des Finances publiques (DGFiP)** that exposed data linked to roughly **680,000** individuals and businesses after unauthorized access in late June 2026. Reporting indicates the compromise involved impersonation or misuse of identity and access privileges, with at least **678,437** affected records later advertised for sale on the dark web by an actor calling itself **ZeroBytes**. The exposed population reportedly included both private taxpayers and professionals, and the intrusion was detected during a routine check before access restrictions were tightened. Separate dark-web reporting tied to the same actor alleges a broader compromise of DGFiP-linked cadastral systems affecting **2,041,778** property holders, including land-registry data associating named individuals with fixed addresses and ownership information. Those claims say the attackers used valid credentials and an alleged multi-factor authentication bypass, and that they offered both the stolen data and continued access for sale, although that second breach had not been publicly verified or acknowledged by DGFiP at the time of reporting. The incident raises immediate risk of **phishing**, business email fraud, and other social-engineering attacks using tax, cadastral, and civil-status data.
Aug 20, 2026
UK Government Investments (**UKGI**), the UK public body that manages state investments, disclosed a data breach after an internal file was left publicly accessible for about 40 hours. The exposed file contained high-level management information along with the names and work email addresses of **51 government officials**, and UKGI said the incident was caused by a staff member failing to follow established information security policies. UKGI said the breach was identified during the 2025–26 financial year, escalated to its board, and voluntarily reported to the UK Information Commissioner’s Office. The agency also commissioned an external security review, which found its response appropriate but recommended stronger security controls and better incident preparedness; UKGI said most of those measures have already been implemented or are planned.
Aug 4, 2026
Organizers of **Abu Dhabi Finance Week (ADFW)** inadvertently exposed sensitive identity documents for roughly **700 attendees** after an associated **cloud storage server was left publicly accessible**. Reporting indicated the exposed files included **passport scans, national ID cards, and other personally identifiable information**, affecting high-profile individuals such as former UK Prime Minister **David Cameron** and other global finance and government figures. An independent security researcher reportedly discovered the dataset using common cloud-scanning tools, and the data may have been accessible for **at least two months** before being addressed. The incident underscores ongoing risk from **misconfigured or unsecured cloud storage** supporting major events and third-party registration workflows, where large volumes of identity documents are collected and retained. Other items in the provided set cover unrelated topics (post-quantum planning, phishing kits, supply-chain malware on Android devices, and general security roundups/advice) and do not add material facts about the ADFW exposure.
Jul 12, 2026