Breaches

BAE Systems cyber incident halts US bankruptcy court notices

A BAE Systems security incident has stopped US bankruptcy court notices for a week. What the supplier outage means for UK organisations.

Server racks with a warning overlay representing the BAE Systems-run Bankruptcy Noticing Center outage

A security incident at BAE Systems has knocked out the service that sends every official notice for the US federal bankruptcy courts, and the outage has now run for a week. No data theft or attacker has been confirmed, but the incident is a clear lesson in what happens when one supplier runs a shared public service.

What happened

The Administrative Office of the US Courts confirmed on Thursday 15 October 2026 that BAE Systems, which operates the Bankruptcy Noticing Center (BNC) under contract, had been affected by a cyber security incident. The BNC produces and sends the notices that federal bankruptcy courts across the United States rely on, both electronically and on paper.

According to the judiciary, the BNC’s systems and websites are unavailable, including bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov and the National Creditor Registration Service. Production and distribution of notices has stopped. The Administrative Office says it is in contact with the affected courts and coordinating with BAE, which it says is investigating and working to restore operations.

Court notices published by the Northern and Eastern Districts of Texas date the disruption to 9 October 2026, which means notices had already been delayed for almost a week before the public confirmation. A BAE spokesperson quoted by The Record said the company is aware of a security incident “isolated to the BNC system”, has taken immediate steps to address it and is coordinating closely with the Administrative Office on the response.

Neither the courts nor BAE have said whether any data was accessed or taken. No ransomware group or other threat actor has been named, no cause has been given, and no date for restoration has been announced.

The detail

The BNC is not a case management system. Courts are still accepting filings, opening cases and processing documents, and BreachNews reports that the separate CM/ECF electronic filing notices continue to work. What has broken is the outbound layer: the service that tells creditors, debtors and other parties that something has happened in a case and that a deadline is now running.

That matters because bankruptcy procedure is built on notice. Notices of the Section 341 meeting of creditors, orders and other court documents carry legal deadlines, and a party who never receives a notice may miss a date that affects their rights. Individual courts have responded in different ways. The Eastern District of Texas has issued two general orders on extensions and relief from deadlines. The Northern District of Texas says it may extend or reset deadlines or continue hearings, while stating that scheduled hearings will go ahead unless the court orders otherwise.

There is a knock-on effect for practitioners too. The Texas courts say the outage has also affected access to the mailing matrix, the list of parties that must be served, and have published a manual workaround through CM/ECF. They warn that this route omits debtors, trustees, the US Trustee and the US Attorney, so lawyers must check their own service obligations rather than trust a single list.

Timeline of the Bankruptcy Noticing Center outage from 9 to 15 October 2026

Why it matters for UK organisations

BAE Systems is one of the UK’s largest companies and a major supplier to British government and defence. The judiciary’s statement does not name which part of the group runs the BNC, and nothing published so far suggests UK systems or UK data are involved. BAE’s own wording places the incident within the BNC system. The UK relevance here is the pattern, not any direct exposure.

That pattern is familiar. A public body hands a nationwide, citizen-facing function to a single supplier. The supplier has an incident. The body discovers that it has no fallback, and the impact lands on the public and on the professionals who depend on the service. The Cyber Security and Resilience Bill is designed partly in response to that shape.

As introduced, the Bill brings relevant managed service providers into scope, overseen by the Information Commission, and lets regulators designate “critical suppliers” whose failure could seriously harm the economy or disrupt the everyday running of society. Law firm Travers Smith’s analysis notes that regulated entities would have to notify their regulator and the NCSC within 24 hours of a significant incident, with a full report within 72 hours, and that providers such as managed service providers must take reasonable steps to promptly tell customers who could be affected. A UK equivalent of the BNC outage, say a contractor running notification services for courts, councils or an NHS function, is exactly the kind of case those clauses are aimed at.

Expert view

In my experience, the most revealing question in any supplier assurance review is not “what controls do you have?” but “what happens to us on the day you go dark?” Most organisations can produce a questionnaire and a certificate for a critical supplier. Far fewer can show a tested process for keeping the service, or at least its legal and safety-critical outputs, running when that supplier is offline for a week.

Two points stand out here. First, the gap between 9 October and public confirmation on 15 October. Downstream users often learn the scope of an incident piecemeal. Second, the outage has spread risk to people who had no relationship with the supplier at all. Creditors and debtors never chose BAE. That is the defining feature of concentration risk in public services, and it deserves far more attention in procurement than it usually gets.

When we test outsourced environments, the shared notification and messaging layer is often treated as plumbing rather than a critical asset. It is often internet-facing and touches every customer. If the investigation eventually shows data was accessed, that will be a separate and serious question. For now, the service failure alone is the story.

What to do now

  1. Map single-supplier dependencies. Identify any service where one contractor delivers a legally required or customer-facing output, particularly notifications, payments and statutory correspondence.
  2. Plan a manual fallback. For each of those services, document how you would issue the essential outputs if the supplier were unavailable for seven days or more, and rehearse it at least once.
  3. Write incident duties into contracts. Require prompt notification of security incidents, regular status updates and evidence of scope, in line with the reporting timescales expected under the Cyber Security and Resilience Bill.
  4. Check supplier access paths. Review how suppliers connect to your environment and enforce Cyber Essentials basics on those routes: secure configuration, least privilege user access control, current patching and multi-factor authentication.
  5. Segment shared services. Make sure a supplier-run platform cannot become a bridge into your core network if it is compromised, and monitor its connections.
  6. Prepare communications. Draft holding statements for customers and partners affected by a supplier outage, so you are not improvising while the supplier investigates.

Bottom line

A week-long outage at a single BAE Systems-run service has stopped official notices across the entire US federal bankruptcy system. There is no confirmed data theft and no named attacker yet, and that may change as the investigation continues. The lesson for UK organisations does not depend on those answers: if one supplier runs something your customers legally rely on, you need a tested plan for the day it stops.

Sources

Related Posts