Press play to start listening
A cyber incident affecting BAE Systems halted US bankruptcy notices, forcing federal courts to change service procedures and adjust some deadlines.
A cybersecurity incident affecting systems operated by BAE Systems Inc. has halted the production and distribution of official notices for US bankruptcy cases. The nationwide outage began on October 9, 2026, disrupting paper and electronic notices sent to creditors, debtors and other parties.
The Administrative Office of the US Courts confirmed the incident on October 15. BAE Systems Inc., the US subsidiary of British defence company BAE Systems plc, operates the Bankruptcy Noticing Center (BNC) systems and websites on behalf of the federal judiciary.
Bankruptcy Notice Websites Offline
The outage has taken several websites offline, including bnc.uscourts.gov, bankruptcynotices.uscourts.gov and notices.uscourts.gov. The National Creditor Registration Service is also unavailable.
“As a result of the incident, all access to the BNC systems and websites that BAE operates on behalf of the judiciary and the related bankruptcy noticing process are unavailable at this time,” the US Courts said.
Federal bankruptcy courts continue to accept filings and process cases, but the outage has stopped paper notices and electronic notices normally distributed through the BNC. Electronic notifications sent directly to registered CM/ECF users remain available in at least some districts, according to an update from the Eastern District of Tennessee.
The outage is also preventing some CM/ECF users from generating or printing creditor lists, sometimes called mailing matrices. Parties who depend on BNC delivery may therefore receive delayed information about hearings, court orders and case filings.
Courts Change Notice Procedures and Deadlines
Because bankruptcy courts administer their own local procedures, responses have varied by district.
Courts have introduced different measures to manage the disruption. In the Southern District of Florida, an order issued on October 16 requires trustees, debtors and their lawyers to handle certain notices normally sent through the BNC. The Eastern District of Louisiana has also assigned responsibility for mailing specified notices to debtors and trustees in certain cases filed since October 7.
Other courts have addressed proceedings affected by missing notices. The Southern District of Indiana and the Middle District of Pennsylvania directed that creditor meetings be adjourned, not concluded, when the outage prevents proper notice from being delivered.
The Southern District of Texas is allowing parties to request deadline extensions, with relief decided individually. Most courts have not introduced automatic deadline extensions, although the Middle District of Florida extended certain service deadlines, while the Eastern District of Texas granted a 30-day extension of the automatic stay in qualifying cases.
BAE Systems Investigating Incident
BAE Systems Inc. said the security incident was isolated to the BNC system and that no other company systems were affected. The company is working with the Administrative Office of the US Courts to restore the affected services.
Neither organisation has disclosed the cause, identified an attacker or said whether bankruptcy data was accessed or stolen. No restoration date had been announced at the time of writing.
Experts Warn of Risks From Reliance on Third-Party Systems
John Strand, owner of Black Hills Information Security, shared his comments with Hackread.com, saying the incident highlights how closely business and government processes are connected.
“A lot of people still think about computer security in terms of a DMZ. There’s an internal network to protect and an outside world to protect it from. But look at any modern large organization. They have multiple SaaS platforms, third-party integrations, and customer data flowing in and out of systems they don’t own or control. That perimeter is a lot messier than people want to believe.”
“I still don’t think the industry has caught up with the risks we introduced through cloud computing and SaaS. Now we’re adding AI to the mix, giving attackers new ways to target those services and exploit the connections between them. We weren’t caught up before. We’re certainly not ready now,” Strand added.
Jacob Krell, Senior Director of Secure AI Solutions and Cybersecurity at Suzu Labs, also shared his comments with Hackread.com, describing bankruptcy notices as “the machinery of due process” and pointing to the judiciary’s reliance on one contractor.
“Judges are already compensating, extending deadlines and continuing hearings district by district. That is the detail that should worry anyone procuring for the courts. The outage never touched a courtroom, yet it rewrote the calendar of every bankruptcy case in the country, because a vendor bought like routine IT has become load-bearing infrastructure for the justice system.”
“Restoring service is the urgent job. The standing question is why the noticing architecture has no alternate path, and I would want the Administrative Office of the U.S. Courts to write continuity requirements into the next BAE contract as strict as the ones the courts impose on themselves,” explained Krell.
