[News](/news) Companies House Data Leak [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) # Companies House Data Leak ##### [UpGuard Team](/team/upguard) March 18, 2026 ### Key facts: GOV.UK data breach * **Date reported:** March 16, 2026. * **Unauthorized access identified:** October 2025 (vulnerability existence reported). * **Target entity:** Companies House (via GOV.UK). * **Source of breach:** Security flaw in WebFiling service (reported by researcher Dan Neidle). * **Data types:** Email addresses, home addresses, residential addresses, and dates of birth of company management personnel. * **Status:** Confirmed; service restored and incident reported to the ICO and NCSC. * **Severity:** Medium; sensitive personal data was exposed to other logged-in users, though passwords and company records remained intact. ## What happened in the GOV.UK data breach? GOV.UK (gov.uk) reported a security incident involving Companies House on March 16, 2026. The incident was caused by a security flaw in its WebFiling service that exposed the personal information of five million registered companies. No threat actor has been identified as responsible for the vulnerability, which was brought to light by researcher Dan Neidle. Companies House confirmed that the flaw allowed logged-in users to access dashboards belonging to other companies. This exposure included sensitive management data such as home addresses, email addresses, and dates of birth. The incident is considered medium severity because while personal data was accessible, user passwords were not compromised and no unauthorized changes were made to company records. The service has since been restored, but the potential for the data to be used in secondary attacks remains a concern. ## Who is behind the incident? The attacker or cause of the incident has not been identified. ## Impact and risks for GOV.UK customers For company directors and management personnel, the exposure of residential addresses and dates of birth presents significant risks. This sensitive information can be leveraged by malicious actors for targeted phishing, identity theft, or social engineering. Even without compromised passwords, the availability of verified personal details allows attackers to build more convincing profiles for fraudulent activities. Typical outcomes of such leaks include an increase in unsolicited contact and potential attempts at credential stuffing. Affected individuals should monitor their credit files for unauthorized activity and exercise caution with unexpected communications. Proactive transparency and reporting to the Information Commissioner's Office (ICO) help in managing the long-term impact on the registered business community. ## How to protect against similar security incidents In light of the Companies House data exposure involving GOV.UK, management personnel of registered companies should take steps to secure their personal and professional information. * ‍**Monitor for identity theft.** Regularly review credit reports for any unfamiliar accounts or inquiries. Consider enrolling in an identity theft protection service to receive alerts about the use of your personal details. Be vigilant for any unexpected physical mail or financial statements sent to your home address.**‍** * **Practice heightened email security.** Treat all unsolicited emails with suspicion, especially those referencing company registry details. Enable phishing-resistant multi-factor authentication (MFA) on all professional and personal accounts. Do not click on links or download attachments from unverified sources.**‍** * **Implement attack surface management.** Organizations should utilize continuous monitoring tools to identify vulnerabilities in public-facing web services. Conduct regular security audits of access controls and dashboard permissions to prevent unauthorized data exposure. Ensure that third-party vulnerabilities are patched promptly as part of a robust patch management strategy. *Maintaining a proactive security posture and monitoring for the misuse of personal data are essential steps in mitigating the impact of this registry leak.* ## Frequently asked questions ### What happened in the GOV.UK security breach? On March 16, 2026, GOV.UK (gov.uk) disclosed a security breach. According to initial reports, a security flaw in the Companies House WebFiling service exposed sensitive information, including home addresses and dates of birth, of five million registered companies. ### When did the GOV.UK breach occur? The GOV.UK breach was publicly reported on March 16, 2026. The exact date of the attack has not been disclosed, though the vulnerability reportedly existed since October 2025. ### What data was exposed? The types of data involved in the GOV.UK incident include email addresses, home addresses, residential addresses, and dates of birth of company management. This page will be updated as verified information becomes available. ### Is my personal information at risk? If you interacted with GOV.UK or are a director of a U.K. company, there's a possibility your personal information could be affected. Similar incidents often involve email addresses, login details, or financial records. Stay alert for updates and take precautionary measures to secure your accounts. ### How can I protect myself after a data breach? • Monitor your credit reports for suspicious activity.\ • Enable [multi-factor authentication (MFA)](https://www.upguard.com/blog/mfa-multi-factor-authentication) on all accounts.\ • Be wary of phishing emails or phone calls using your personal details.\ • Use breach monitoring tools to track the exposure of your email address. ### What steps should companies take after being breached? Companies House has restored the WebFiling service, reported the incident to the ICO and NCSC, and is conducting an investigation. They are expected to review security measures and deploy enhanced monitoring to prevent future vulnerabilities. *This cybersecurity news article is powered by *[*UpGuard Breach Risk*](https://www.upguard.com/product/breach-risk)* — continuous attack surface monitoring for your organisation and supply chain.* ## How secure is GOV.UK? GOV.UK operates the official website of the United Kingdom government, providing a centralized digital platform for citizens and businesses to access public services and information. The site consolidates government departments, services, and resources including tax administration, benefits, immigration, licensing, and regulatory guidance. * View our free preliminary report on GOV.UK’s security posture * 13 risk factors, including email security, SSL, DNS health, open ports and common vulnerabilities [View GOV.UK's score](/security-report/gov-uk) [View score](/security-report/gov-uk) [https://www.gov.uk/](/security-report/gov-uk) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ## Latest news Stay up-to-date with the latest news in cybersecurity. [](/news/hugging-face-data-breach-2026-07-20) #### [Hugging Face data breach: key facts and what we know so far](/news/hugging-face-data-breach-2026-07-20) A data breach involving Hugging Face was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 20, 2026 [](/news/ey-data-breach-2026-07-19) #### [EY data breach: what happened and what's at risk](/news/ey-data-breach-2026-07-19) A data breach involving EY was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) #### [South Florida Injury & Convenient Care data breach exposes names and Social Security numbers](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) A data breach involving South Florida Injury & Convenient Care was reported in July 2026. See incident details, impact on customers, and security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/park-west-psychology-data-breach-2026-07-16) #### [Park West Psychology data breach: what happened and what's at risk](/news/park-west-psychology-data-breach-2026-07-16) A data breach involving Park West Psychology was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) #### [Fall River Municipal Credit Union data breach: what happened and what's at risk](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) A data breach involving Fall River Municipal Credit Union was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [](#) July 14, 2026 [](/news/npcil-data-breach-2026-07-16) #### [NPCIL data breach: World Leaks claims exposure of Kudankulam Nuclear Power Plant files](/news/npcil-data-breach-2026-07-16) A data breach involving NPCIL was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 14, 2026 [View all news](/news) ## Protect your organization Get in touch or book a free demo. [Contact sales](/demo) [Free demo](/demo) ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)