The US judiciary says a cybersecurity incident at BAE Systems, which runs the Bankruptcy Noticing Center for the courts, has taken its websites offline and halted the production of bankruptcy notices nationwide. No information has been published so far on any data access.
What happened
On 15 October 2026, the Administrative Office of the U.S. Courts announced that the IT systems and websites supporting the Bankruptcy Noticing Center (BNC) had been hit by a cybersecurity incident. The BNC is operated for the federal judiciary by the contractor BAE Systems, which is investigating and working to restore service. The incident has halted the production and distribution of bankruptcy notices, the formal letters and e-mails that inform creditors and debtors of each step in a case.
Four services are unavailable: bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov and the National Creditor Registration Service. Because the BNC handles notices for every bankruptcy court, the whole country is affected.
What we know about the attack
Neither the judiciary nor the contractor has said how the attackers got in or whether data was taken. According to The Record, BAE Systems said the incident is isolated to the BNC system and that it took immediate steps to address it, while the judiciary says it is coordinating with the contractor and the courts concerned. We will update this article only on the basis of official statements.
What to do now
- List the services run by a provider on which your legal, billing or customer obligations depend, and the deadline that applies if they stop.
- Write a fallback procedure for each one: manual sending, alternative channel, who decides and who informs customers.
- Check your contracts: incident notification time, right to audit, logs you can obtain, and restoration commitments.
- Be wary of fake notices: during an outage, criminals often send e-mails that imitate the missing official messages; confirm any payment request through a known channel.
Our take
Outsourcing a service does not outsource the obligation it fulfils. A company should know, for each critical supplier, how it would keep working for a week without it, and test that plan before it is needed.
Sources
- U.S. Courts — Cybersecurity Incident Disrupting Bankruptcy Court Operations
- The Record — Federal bankruptcy courts dealing with cyberattack outage
How we choose, verify and write our analyses →
The way in was a third party. Check what your suppliers expose publicly — no intrusion, public information only:
Worried your servers are exposed? Our team audits, patches and monitors Linux and cloud infrastructure 24/7.
Talk to an expert Our managed server services →
