Is Companies House's website not done by GDS or something? I worked on a few GDS projects for DFT, we had to have independent pen testers test our services before they moved between phases.
Not saying they were compromised.
They provide data feeds to many third parties, who might themselves be vulnerable, hence the notification.
[1]: https://forum.aws.chdev.org/t/cross-site-scripting-xss-softw...