BAE Systems cyber incident halts US bankruptcy notices

A cybersecurity incident at defense contractor BAE Systems has stopped the system that sends bankruptcy notices for every federal bankruptcy court in the United States. The judiciary's Administrative Office disclosed the incident on October 15, 2026, and four related websites were still offline on October 16. The outage shows how one vendor's breach can freeze a public service that depends on it.

BAE Systems runs the Bankruptcy Noticing Center, or BNC, for the federal courts. The BNC produces and sends the notices that tell creditors and other parties about bankruptcy cases. The incident "has halted BNC production and distribution of bankruptcy notices," the courts' statement says.

What is offline

All access to the BNC systems and the websites BAE runs for the judiciary is unavailable, according to the courts. The courts' statement, CyberScoop, Infosecurity Magazine and the ABA Journal list the same four services as offline:

• bnc.uscourts.gov, the Bankruptcy Noticing Center site
• bankruptcynotices.uscourts.gov
• notices.uscourts.gov
• the National Creditor Registration Service

The rest of the bankruptcy system is still running. Courts are still accepting filings, opening cases and processing paperwork, CyberScoop reports.

How the disclosure unfolded

The problem started a week before the courts called it a cyber incident. Notice production and distribution stopped on October 9, according to CyberScoop. A bankruptcy court website then posted a notice on Tuesday, October 13, describing a "nationwide service interruption," with no mention of security.

The Administrative Office's October 15 statement was the first to use the words "cybersecurity incident," CyberScoop reports. It said BAE is "actively investigating this incident and working to restore operations."

A BAE Systems spokesperson said: "We are aware of a security incident that is isolated to the BNC system and have taken immediate steps to address it." The spokesperson added: "No other systems have been affected." BAE is coordinating closely with the courts, Infosecurity Magazine reports.

What is still unknown

Neither the courts nor BAE has said what kind of attack this was. Neither has said whether any data was accessed or taken. There is no date for restoring the service.

The BNC is run by a US subsidiary of BAE Systems, the British aerospace company, the ABA Journal reports. CyberScoop calls this the second incident in two years affecting the US courts, after a 2025 breach of the federal electronic case filing system.

Advice for people who must serve notices

With the BNC down, the courts' own notice service is not reaching parties. CyberScoop says filers who must serve documents can search party and creditor addresses in CM/ECF, the courts' electronic filing system, and compare the results.

There is a catch. Those lists may leave out addresses that were registered through the BNC's electronic noticing or the National Creditor Registration Service. Some parties who are owed notice could therefore be missed.

What this means for developers

• Map which vendors run your critical paths. The courts' filing system still works, but notices stopped because one contractor's system failed. List every outside service your product cannot run without.
• Plan a manual fallback. Filers here are now told to pull addresses by hand from another system. Decide in advance how your users get an essential message when the usual channel is down.
• Disclose early and plainly. The first public notice called this a "service interruption." A clear early statement helps the people who depend on a system plan around it.
• Expect phishing that copies the outage. A well-known service going dark is a lure for fake "service restored" emails. If you run a public service, tell users where real updates will appear.
• Separate systems so one breach stays contained. BAE says the incident is isolated to the BNC system. Network separation is what makes a claim like that possible.