Email Companies House: After WebFiling Incident, You Must Stop Forcing One Login Digital ID on Directors

Use our tool to send an email to Companies House - always better if you add your own thoughts and comments to the template. If you are a Director and will not be complying, tell them.

Name *

Your email *

Subject

I am writing to express my strong opposition to the ongoing rollout that is effectively forcing millions of company directors into a compulsory digital identity system through GOV.UK One Login. This concern is particularly urgent in light of the recent Companies House WebFiling security breach, which exposed millions of sensitive personal records including directors’ dates of birth and residential addresses, and may have enabled unauthorised changes to company records. AccountingWEB reports that Companies House was contacted about the issue prior to its discovery, but the alert did not receive a response. If true, this failure to act on a clear warning demonstrates that even when risks are identified, the organisation may not adequately protect directors and their companies.We are told the vulnerability was introduced during a system update in October 2025, shortly after a renewed strategic push toward transformation and expanded digital capability. Regardless of intent, this raises serious questions about whether speed of delivery has been prioritised over robustness, assurance, and security. If this exploit has been used by malicious actors, the consequences may be severe: company records could be manipulated, bank transactions misappropriated, and directors left personally and financially exposed.Against that backdrop, it is wholly unacceptable to continue rolling out a policy that compels millions of directors to entrust even more sensitive identity data to centralised digital infrastructure.Companies House has justified the move to One Login on the basis of tackling fraud, economic crime, and identity misuse, while also stating that it takes data protection responsibilities “extremely seriously.” The recent incident - combined with the reported failure to respond to warnings - directly calls both of these claims into question. A system that cannot reliably prevent unauthorised access or modification of company records cannot credibly demand increased volumes of highly sensitive identity data from the public.Companies House has suggested that this is “not a digital ID system.” That assertion is not credible. Requiring individuals to verify their identity using official documents such as passports or driving licences, linking that identity persistently to official records, and making that system effectively mandatory for participation in essential economic activity is, by any reasonable definition, a state-controlled digital identity system.The British public has consistently rejected compulsory identity systems, and no democratic mandate exists for their introduction. Implementing such a system indirectly, through regulatory compulsion tied to company law, bypasses proper scrutiny and risks undermining public trust.The reliance on One Login is particularly concerning given widely reported issues. In December, ITV News highlighted whistleblower claims that the system may already be compromised, citing security weaknesses, inadequate internal controls, outsourcing risks, and poor treatment of staff raising concerns. Whether or not all claims are substantiated, the existence of credible risk alone should preclude mandating its use nationally without full transparency and independent assurance.The lesson from the WebFiling incident is clear: centralised digital systems can and do fail, even when operated by trusted public institutions. When they fail, the consequences are not abstract - they affect real individuals, exposing personal data and creating opportunities for fraud, including potential misuse of company records and financial assets.In that context, forcing directors into a single, primary digital verification channel represents a concentration of risk that is both unnecessary and disproportionate.While Companies House points to an alternative route to One Login via Authorised Corporate Service Providers (ACSPs), this is not a genuine or equitable alternative. It introduces additional cost, intermediaries, and complexity, effectively penalising those who do not wish to use One Login. A safeguard that requires individuals to pay to avoid a mandated digital system is not a meaningful choice.A true alternative must be free, direct, and accessible - not outsourced or conditional on additional expense.I therefore urge Companies House to:<ul><li dir="ltr" aria-level="1">Pause further expansion of effectively mandatory GOV.UK One Login requirements</li><li dir="ltr" aria-level="1">Publish full technical details and an independent review of the WebFiling security incident, including why an apparent warning was not acted upon</li><li dir="ltr" aria-level="1">Provide clear evidence as to whether any unauthorised access or changes have occurred</li><li dir="ltr" aria-level="1">Commit to maintaining a free, direct, and accessible non-digital verification route for all directors</li><li dir="ltr" aria-level="1">Ensure any expansion of digital identity requirements is subject to full public consultation and parliamentary scrutiny</li></ul>Trust in Companies House is foundational to the UK’s business environment. That trust has been damaged. Continuing to expand compulsory digital identity requirements in the current circumstances risks compounding that damage significantly.Until confidence is demonstrably restored, and a genuinely fair alternative is provided, this approach should not proceed further.

To show you're an actual person, what is 2 + 4 ? *

Yes - please keep me in touch with Together's campaigning on this and related issues

Data will be processed by Organic Campaigns: Privacy policy. Acknowledgements