.jpg?w=1024)
A cybersecurity incident affecting BAE Systems’ Bankruptcy Noticing Center systems has halted a service used to distribute notices for US federal bankruptcy courts.
The incident has disrupted the Bankruptcy Noticing Center (BNC), which BAE Systems operates for the federal judiciary to produce and distribute bankruptcy notices nationwide.
Per Reuters, the outage has also taken related websites offline, interrupting a service that courts rely on to notify parties about developments in bankruptcy proceedings.
The consequences extend beyond inaccessible websites. Delayed notices and orders could complicate how creditors, debtors, and attorneys track court proceedings, and the outage has also affected users' ability to generate and print creditor lists through the courts' electronic filing system.
What we know so far about the incident
According to SecurityWeek, the disruption came to light on Oct. 9, when BAE Systems notified the Administrative Office of the US Courts of a service interruption affecting systems used to process bankruptcy notices.
The judiciary publicly disclosed the cybersecurity incident on Oct. 15, confirming that it disrupted the Bankruptcy Noticing Center (BNC).
In its Oct. 15 announcement, the judiciary said BNC systems and related websites were unavailable and the center’s production and distribution of bankruptcy notices had stopped.
The affected services include bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service, which supports access to creditor mailing lists. The Eastern District of Texas said the disruption interrupted the court polling and certification processes supporting electronic and paper notice delivery.
The reviewed public statements do not identify the cause of the incident or establish whether any data was accessed or stolen.
BAE Systems told BleepingComputer that the security incident was isolated to the BNC system and that it had taken immediate steps to address it. The company is investigating the incident and coordinating with the judiciary, but the cited reports have not announced a confirmed restoration timeline.
The outage does not affect every court notification channel. The US Bankruptcy Court for the Middle District of Alabama said Notices of Electronic Filing continued normally through CM/ECF, while the court explored alternative ways to deliver court-issued documents.
When third-party dependencies become critical points of failure
Businesses cannot always build and manage every system they depend on internally.
Outsourcing services can help reduce costs and limit administrative overhead. But the trade-off is that some of their operations now depend on supply-chain risks they neither fully know of nor control.
As John Strand, owner of Black Hills Information Security, explains to eSecurityPlanet, “A lot of people still think about computer security in terms of a DMZ. There’s an internal network to protect and an outside world to protect it from.”
Modern organizations, however, rely on multiple software-as-a-service (SaaS) platforms, third-party integrations, and data flowing through external systems. “That perimeter is a lot messier than people want to believe,” Strand says.
This is the supply-chain risk at the center of this incident: an organization can secure its own network and still suffer disruption when a provider it depends on experiences a security incident.
For security teams, those dependencies make availability part of vendor risk management: a provider’s outage can interrupt essential work even when the customer’s own network remains available.
The BAE Systems incident shows how serious those dependencies can become when they underpin a critical public function.
Jacob Krell, senior director of secure AI solutions and cybersecurity at Suzu Labs, describes bankruptcy notices as “the machinery of due process” and argues that the judiciary has made a single contractor responsible for a service that courts depend on to keep bankruptcy proceedings moving.
As Krell puts it, “The outage never touched a courtroom, yet it rewrote the calendar of every bankruptcy case in the country.”
His concern goes beyond the immediate outage to the lack of an alternative if the contractor cannot provide the service, asking why “the noticing architecture has no alternate path.”
That is the wider lesson for organizations: third-party providers are often necessary, but the services they supply can become so essential that their failure disrupts operations far beyond the vendor itself.
For essential outsourced services, organizations should establish how long they can tolerate an outage and test an alternative process. Depending on the service, that could involve a secondary provider, a manual workflow, or an internal capability.
What defenders can do
Cybersecurity defenders cannot prevent every attack, but they can close the gap between when an attack occurs and how long things stay down.
Organizations should have tested incident-response plans and disaster-recovery plans that define how they will isolate affected systems, investigate the incident, restore clean and trusted operations, and keep essential services running as soon as possible.
The incident also reinforces the need to account for third-party dependencies in recovery planning. Security and business teams should identify which workflows depend on each critical provider, set acceptable outage durations, and assign responsibility for activating an alternative process.
Recovery exercises should test whether that alternative works without access to the affected vendor’s systems. Teams should also establish how they will communicate delays, track work completed during the outage, and reconcile the backlog after service returns.
For defenders, the goal is not simply to keep attackers out; it is also to ensure that when an incident gets through, essential operations can recover quickly.
Read more: The Frontline Education breach highlights why vendor risk reviews must also examine the software providers depend on.