UK Companies House Suspends WebFiling Over Access Flaw

Companies House, the UK's official corporate register, suspended its online WebFiling service on Friday after a security vulnerability allowed users to access and potentially alter the personal details of other registered companies, exposing millions of businesses to fraud risks.

The flaw, described as straightforward to exploit, came to light when Dan Neidle, founder of Tax Policy Associates, was alerted by John Hewitt of business service provider Ghost Mail. Users could log in with their own credentials, attempt to file documents for another company by entering its registration number, and then navigate back through the browser. This maneuver redirected them to the target company's dashboard without proper authentication, granting unauthorized access to sensitive information.

The vulnerability potentially affected records for more than five million companies on the register, including major FTSE 100 firms such as AstraZeneca, Shell, and Tesco. Exposed data included directors' home addresses, email addresses, and dates of birth, which could facilitate phishing attacks or identity theft. More alarmingly, it enabled modifications to company details, such as changing addresses or...