Cyberattack on BAE Systems takes down US federal bankruptcy notice system

A contractor breach takes a court service offline

The US federal bankruptcy notice system went offline after a cyberattack that targeted not the courts themselves but a company running a service on their behalf. According to the Administrative Office of the US Courts (AOUSC), an attack on BAE Systems disrupted the Bankruptcy Noticing Center (BNC), the operation that produces and sends out notices for federal bankruptcy courts. BleepingComputer reported the outage on October 16, 2026, citing an AOUSC statement dated October 15, and said both the production and the distribution of notices had halted.

BAE is a substantial supplier rather than a niche one. BleepingComputer describes the company as Europe's largest defense contractor and a significant provider of enterprise IT, cloud and cybersecurity services to government agencies. That detail is central to why the incident resonates beyond bankruptcy court: a firm that sells security and IT services to government became the point at which a core court function stopped working.

What is offline

The AOUSC says the BNC systems and websites that BAE operates for the Judiciary are unavailable. Four services are affected: bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov and the National Creditor Registration Service.

In a statement to BleepingComputer, BAE said it was aware of a security incident "isolated to the BNC system" and was coordinating with the AOUSC. The courts say the contractor is investigating and working to restore operations. Neither party has given a date for when the services will return.

What is still unknown

The public record leaves most of the defining questions open. It does not say when the attack started or was detected, whether any data was accessed or removed from the BNC environment, or who is behind it — no ransomware group or other threat actor has been named. Until those facts emerge, BAE's word "isolated" describes where the damage sits, not how extensive it is, and early scoping statements from a vendor in the middle of an investigation are best treated as provisional rather than final.

The Judiciary's second incident in two years

This is not the federal Judiciary's first recent cyber episode. In 2025 it said it was strengthening its defenses after an attack on its electronic case management systems, and it introduced stricter access controls around certain sealed filings containing sensitive information. The Judiciary has not confirmed any breach of confidential documents, though Politico reported in August 2025 that intruders had breached the CM/ECF and PACER systems and accessed sensitive data, including the identities of confidential informants.

The two incidents differ in an instructive way. The 2025 intrusion affected systems the Judiciary operates itself. The 2026 one arrived through a system a contractor operates for it — a door the courts do not directly control, whatever hardening they applied after the first attack.

One vendor, many services

Bankruptcy runs on notice: creditors, debtors and attorneys need to be told what is happening in a case. An outage does not have to touch a single case file to cause harm; stopping the flow of notices is enough, even while the courts themselves keep functioning.

The structural lesson is concentration. Four public-facing Judiciary services shared one contractor, and one incident took all of them down together. Third-party risk programs tend to rank vendors by how much sensitive data they hold, and far less often by how much of a business process stops when the vendor goes dark. By the first measure a notice service can look low-risk. By the second it is critical.

Why it matters

The episode shows that outsourcing a function does not outsource the risk or the accountability. The AOUSC's name is on the outage, the courts absorb the operational damage, and the public sees a federal court service offline. The same pattern — a core function handed to a single managed service provider — is how most organizations, public and private, buy services today, and most have never tested what happens when that provider fails. How serious this becomes now depends on the unanswered questions: how the attacker got in, how long they were inside, whether any data left the BNC environment, and when notices will start flowing again.