- A cybersecurity incident at BAE Systems, which runs the Bankruptcy Noticing Center for the federal judiciary, has stopped bankruptcy notices for all federal bankruptcy courts.
- Courts still accept filings, but the manual backup may omit people who registered addresses through the center's programs, so some may not be notified.
- Leaders should list which outsourced systems send legally required messages, and ask what their fallback would miss.
The courts are open. The notices are not going out.
A court case is more than a ruling. It also leaves a record that the right people were told. This week, one link in that record stopped working for every federal bankruptcy court.
The Administrative Office of the U.S. Courts said a cybersecurity incident affected BAE Systems IT and the websites that support the Bankruptcy Noticing Center (BNC). The BNC creates and sends bankruptcy notices for all federal bankruptcy courts. BAE Systems operates the center's systems and websites on behalf of the federal judiciary.
The judiciary says all access to those systems is unavailable. Three websites on the uscourts.gov domain are down. So is the National Creditor Registration Service. The related process of producing and sending notices has halted.
CyberScoop reports that no notices, paper or electronic, have gone out since Oct. 9. It also reports the sites were still offline on Friday.
Why one contractor's outage reaches every court
The design is simple. One central center sends notices for every court, instead of each court doing its own. That saves effort and keeps notices consistent. It also means one outage reaches every court at once.
The center also holds data the courts' own systems may lack. CyberScoop reports that two programs store addresses people registered themselves. Those are the Electronic Bankruptcy Noticing program and the National Creditor Registration Service. The second is now offline.
The workaround and what it leaves out
CyberScoop reports on a statement from Clerk of Court Joe Falzone. Courts continue to accept new filings, open cases and process paperwork.
Anyone who must serve documents has a manual route. They search the courts' electronic filing system for creditor and party addresses. Then they compare the two lists to look for gaps.
The notice itself carries a caution. Those lists might not hold addresses registered through the BNC programs. As CyberScoop puts it, some people owed notice may be missing from the records.
The lesson reaches well beyond courts. Work can continue while proof of delivery gets thinner. A manual fallback is only as complete as the data it can reach. Here, some of that data sits inside the system that is down.
From "service interruption" to "cybersecurity incident"
The public description shifted over a few days. Notices stopped on Oct. 9. CyberScoop says the first public note appeared Tuesday on the bankruptcy court website. It called the event a "nationwide service interruption" and did not mention cyberactivity.
Per CyberScoop, the public record described the event in security terms only with the Administrative Office's Oct. 15 statement. The sources do not say when the judiciary first learned the cause.
Neither message explained what caused the outage, whether data was reached, or when service might return. CyberScoop asked BAE Systems for comment and reported no reply. These are open questions, not findings. The sources do not say what happened inside BAE's systems.
CyberScoop also points to an earlier episode: a major 2025 breach of the courts' electronic case filing system. The sources do not link the two events.
Questions to put to your team
Many organisations have their own version of the BNC. It might be a vendor that sends invoices, privacy notices, recall letters or regulatory filings. Four questions are worth asking.
First, which outsourced systems send messages we must deliver by law or contract? Second, who holds the contact lists, and can we get a current copy without the vendor? Third, if the vendor stops sending, how would we know whom we missed? Fourth, what does our contract say about how fast the vendor must report a security incident, and in what words?
A contractor can run a function for you. It cannot carry your duty to the people on the other end. When the messenger stops, the duty stays with you.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Administrative Office of the U.S. Courts.
