Estate agents and letting agents are being urged to check their company records after a Companies House security fault briefly exposed sensitive data and raised the risk of unauthorised changes to business details.
The issue affected the WebFiling service used by thousands of property firms to submit accounts, update director information and manage company records, meaning agencies could have been among those impacted.
Companies House said the fault, discovered on Friday 13 March, meant a logged-in user with the correct authentication code could potentially view or alter certain details on another company’s record after carrying out a specific sequence of actions.
The service was taken offline while the problem was fixed and only returned to operation on Monday 16 March after independent testing.
WIDESPREAD CONCERN
While the problem was not accessible to the general public, the incident has caused concern for estate and letting agencies that rely on the system to maintain compliance, particularly as the property sector has a high number of small limited companies and sole-director firms.
Companies House confirmed that some information not normally visible on the public register may have been exposed to other logged-in users, including dates of birth, residential addresses and company email details.
It also said there was a possibility that unauthorised filings – such as changes to directors or accounts submissions – could have been made on another company’s record, although no confirmed cases have yet been reported.
SECURITY ISSUE
In a statement on Friday last week Andy King, Chief Executive of Companies House, said: “On Friday 13 March, Companies House was made aware of a security issue which meant that a logged-in user of our WebFiling service could potentially access and change some elements of another company’s details without their consent after performing a specific set of actions.
“This was not accessible to the general public. Only users with an authorised code and logged in to the service could have performed this action.
“We are asking all companies to check their registered details and filing history to make sure everything appears correct.
“I recognise that this incident will have caused concern and inconvenience to many of the companies and individuals who rely on our services. I am sorry for that.”
