On March 16, 2026, Companies House sent an official email to registered users stating that it had become aware on Friday, March 13 of a security issue in its WebFiling system that may have allowed logged in users to access and alter certain company details without authorization, prompting the temporary shutdown of the service while the issue was investigated and resolved. Source: Companies House

For months, a simple flaw allowed logged-in users to access and potentially alter the private records of millions of companies. Companies House, the UK government agency responsible for registering and maintaining company records, provides a WebFiling system through which businesses submit documents, update information, and file accounts or confirmation statements electronically. Due to the undetected flaw, sensitive data such as residential addresses, dates of birth, and registered email addresses may have been exposed. Even more concerning, unauthorised filings could have been submitted without detection.

"It demonstrates that the barriers protecting corporate data are often thinner than assumed."

This was not a sophisticated cyberattack. It was a basic failure of system design. A user could move between dashboards by exploiting a navigation flaw, effectively stepping into another company’s private account. The simplicity of the exploit is precisely what makes it so alarming. It demonstrates that the barriers protecting corporate data are often thinner than assumed. Although authorities have stated that there is no confirmed evidence of widespread abuse, the reality is more uncomfortable.

Fragile Secrecy: Why the Breach Matters for Litigation Funding Models

The Companies House incident highlights just how fragile secrecy can be in today’s digital age. In a system driven by technology, it takes remarkably little for boundaries to break down. A simple flaw exposed private dashboards, demonstrating how easily confidential information can slip through the cracks. The ramifications of this breach go far beyond corporate administration. When examining litigation funding, it's clear that these business models are built on confidentiality and tightly controlled information flows. The simplicity of the Companies House breach underscores the vulnerability of such systems, showing how a single leak, breach, or unauthorized access could unravel the complex financial structures behind litigation funding arrangements.

"In today’s digital landscape, the risk of information exposure is constant."

Litigation funder Therium has already faced significant criticism for its involvement in high-profile cases like Gbarabe v. Chevron and the Sulu Arbitration. One of the most concerning aspects of Therium’s approach is its use of opaque financial structures, including offshore finance. These hidden arrangements potentially enable funders to exert disproportionate influence over legal proceedings, often at the expense of the very claimants they are meant to support.

Firms like Therium rely on a certain level of opacity. Their business model depends on keeping key details, such as who is funding which cases, how capital is structured, and how returns are distributed, largely out of the public eye. This discretion is not incidental; it is central to how high-risk, high-value litigation strategies are executed across multiple jurisdictions. However, the assumption that such arrangements can remain concealed is becoming increasingly difficult to defend. In today’s digital landscape, the risk of information exposure is constant.

The Sulu Heirs and a Case Built on Fragile Foundations

As financial scrutiny and information exposure increase, the fragility of the Sulu heirs' arbitration campaign becomes even more evident. The case ultimately collapsed under legal scrutiny, with courts rejecting the massive award initially granted, revealing significant weaknesses in both the legal arguments and the broader strategy behind the claim.

The financial and legal structures supporting the Sulu claim are increasingly vulnerable to exposure in a world where maintaining secrecy is becoming more difficult. Much like the Companies House breach, which revealed supposedly protected data due to a basic system flaw, the funding behind these cases is now at risk of being uncovered.

At the heart of this campaign was the reliance on external funding, particularly from Therium. This dependence exposed the fragility of the entire legal effort. Without sustained financial backing, the claims would not have progressed as far as they did, highlighting the central role that such funding plays in propelling lawsuits, regardless of their merit.

"In regions already plagued by governance challenges, such as Mindanao and Sulu, opaque financial structures only increase the potential for exploitation."

In regions already plagued by governance challenges, such as Mindanao and Sulu, opaque financial structures only increase the potential for exploitation. Recent cases of financial misconduct, like the embezzlement of public funds in Sulu by NGO leader Johanne Edward B. Labay, have revealed the vulnerabilities in local governance. These incidents underscore the systemic weaknesses in Sulu’s governance, which have allowed larger corruption schemes to thrive. This case serves as a reminder of the risks when oversight is weak. It shows how these vulnerabilities can be exploited not just for personal gain, but also to manipulate legal processes, ultimately undermining public trust.

The Illusion of Security: A System that Can No Longer Stay Hidden

Taken together, these developments reveal a consistent pattern. The illusion of secure, closed systems is breaking down. What once appeared insulated, legally, financially, and digitally, is becoming increasingly exposed.

For Therium, this illusion of security is not only structural but central to its business model. It offers claimants, including the supposed Sulu heirs, the promise of justice, yet in practice that promise begins to resemble a high-risk and opaque financing arrangement. The gap between perception and reality is narrowing.

"Just as the digital system allowed unauthorized access, the financial ecosystem in Sulu allowed unauthorized access to public funds."

The Companies House breach is more than an isolated technical failure. It reflects a wider unraveling. Systems assumed to be secure have proven permeable, and structures designed to obscure are becoming transparent. Just as the digital system allowed unauthorized access, the financial ecosystem in Sulu allowed unauthorized access to public funds.

For years, Therium operated under the illusion that offshore structures and complex contracts could shield it from scrutiny. The Companies House breach serves as a stark reminder that in the digital age there is no offshore. There is only delay. For the supposed heirs of Sulu, that delay is now over. The courts have spoken, and the fragile foundation, financial, legal, and ethical, has begun to crumble.

The lesson is simple but far-reaching. In a digital world, secrecy is fragile. For those whose strategies depend on it, that fragility may prove decisive.

REFERENCES

BBC News. (2026, March 16). Firms urged to check if other users edited their data on Companies House. BBC News. https://www.bbc.co.uk

Daily Security Review. (2026, March 18). Companies House confirmed a vulnerability that put millions of business records at risk. Daily Security Review. https://dailysecurityreview.com

Know Sulu. (2026, January 2). Jersey’s hidden conspiracies: From Russian billions to the Sulu arbitration. Know Sulu https://know-sulu.ph

Know Sulu. (2025, November 14). Therium’s activity underscores national security risks in litigation funding. Know Sulu. https://know-sulu.ph

Know Sulu. (2025, August 15). NGO leader convicted for misuse of development assistance funds in Sulu. Know Sulu. https://know-sulu.ph

Tax Policy Associates. (2026, March 13). Companies House flaw exposed five million directors and enabled company hijacking. Tax Policy Associates. https://taxpolicy.org.uk