A cybersecurity incident at defense and IT contractor BAE Systems has stopped federal bankruptcy courts across the country from sending notices to creditors and debtors, the Administrative Office of the U.S. Courts said Thursday. The outage shows how a single contractor-run system can halt a nationwide government function that businesses and lenders depend on.

What Happened

In a notice posted Thursday, the Administrative Office, which handles administration for the federal courts, said the incident affected BAE Systems IT systems and websites that support the Bankruptcy Noticing Center. BAE operates the center for the judiciary. It produces and sends bankruptcy notices, the formal messages that tell parties about filings, deadlines and hearings, for federal bankruptcy courts nationwide.

The incident has halted the center's production and distribution of notices, the Administrative Office said. All access to the center's systems and websites run by BAE is unavailable, including bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov and the National Creditor Registration Service. The office said it is in contact with affected courts and coordinating with BAE, and that "BAE is actively investigating this incident and working to restore operations."

RelatedCenterPoint Energy Breach Hit More Than 1 Million Texans, Utility Told State

The disruption began before the judiciary described it as a security matter. A notice from the bankruptcy court for the Eastern District of Texas, posted Oct. 13, said BAE told the Administrative Office late Friday, Oct. 9, of a "service disruption" that left the center unable to provide noticing services to courts. That notice did not mention a cyber incident.

A BAE spokesperson told The Record, a Recorded Future News publication, that the company is "aware of a security incident that is isolated to the BNC system" and took immediate steps to address it. The Administrative Office did not answer The Record's questions about the nature of the incident or whether data was stolen. The Cybersecurity and Infrastructure Security Agency referred questions to the courts, and the FBI did not respond, The Record reported.

Why It Matters

Bankruptcy cases run on notice. Creditors learn of filings, claim deadlines and hearings through these messages. SecurityWeek reported that paper and electronic notices issued through the center since Oct. 9 have not been delivered, and that with the creditor registration service offline, electronic filers cannot generate the creditor mailing lists they normally use to serve documents.

Some functions continue. According to SecurityWeek, electronic filing notifications to registered attorneys, trustees and the U.S. Trustee are still going out, and courts are still accepting filings and opening cases. Lenders, trade creditors and debtors that depend on mailed or emailed notices are the most likely to miss something.

For boards and agency leaders, the case is a reminder of concentration risk: when one contractor runs a central system for an entire government function, an incident at that vendor becomes a nationwide outage. Contract terms on incident notification, backup procedures and restoration targets matter as much as the vendor's own defenses.

Context

The federal judiciary has faced repeated attacks on its systems. The Record noted a 2020 attack on the courts' docketing system, and the judiciary said last year it was tightening access to certain sealed filings after a cyberattack on its electronic case management systems, according to BleepingComputer. The Record also reported that the Department of Transportation said Oct. 14 that a safety agency contact center went offline after a separate contractor was hit by a cyberattack.

What to Watch

The Administrative Office has given no restoration timeline. Key questions are what kind of incident occurred, whether any creditor or debtor information was accessed, and whether courts will extend deadlines or order other ways to serve notice while the center is down. None of the outlets covering the incident has reported a claim of responsibility.