- What: The Administrative Office of the US Courts (AOUSC) said a cyberattack on government contractor BAE Systems took down the notice system used by federal bankruptcy courts.
- Impact: Production and distribution of bankruptcy notices stopped, and bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov and the National Creditor Registration Service are unavailable.
- Fix / mitigation: BAE says the incident is isolated to the BNC system and is investigating and working to restore operations in coordination with the AOUSC; no restoration date has been announced.
- Who's at risk: Federal bankruptcy courts, plus the creditors, debtors and attorneys who rely on court notices, and any agency whose core public-facing service is run by one outside contractor.
The federal bankruptcy system did not go down this week because a court was hacked. It went down because a contractor was. The Administrative Office of the US Courts (AOUSC) said a cyberattack on government contractor BAE Systems took down the notice system federal bankruptcy courts use, and production and distribution of bankruptcy notices has stopped. BleepingComputer reported the story on October 16, 2026, after an AOUSC release dated October 15.
BAE is no small vendor. BleepingComputer describes it as Europe's largest defense contractor and a major provider of enterprise IT, cloud and cybersecurity services to government agencies. That is exactly why this incident matters beyond bankruptcy court. The company that sells security services to government was the point where a core court function failed.
What is down
According to the AOUSC, the BNC systems and websites BAE operates for the Judiciary are unavailable. The affected services are:
- bnc.uscourts.gov
- bankruptcynotices.uscourts.gov
- notices.uscourts.gov
- The National Creditor Registration Service
BAE told BleepingComputer: "We are aware of a security incident that is isolated to the BNC system." The AOUSC said BAE is "actively investigating" and working to restore operations, and BAE says it is coordinating with the AOUSC.
The public record does not yet say when the attack began or was detected, how long the outage will last, whether any data was taken, or who is responsible. No ransomware group or other threat actor has been named. Until those facts are out, "isolated" describes where the damage is, not how much there is.
A Judiciary that has been here before
This is not the Judiciary's first cyber incident in recent memory. In 2025 it said it was strengthening its defenses after a cyberattack hit its electronic case management systems, and it now applies stricter access controls to certain sealed filings that contain sensitive information. The Judiciary has not confirmed a breach of confidential documents. A Politico report from August 2025 said hackers breached the CM/ECF and PACER systems and accessed sensitive data, including the identities of confidential informants.
Look at the two incidents side by side. The 2025 attack hit systems the Judiciary runs itself. The 2026 incident hit a system a contractor runs for it. Whatever the Judiciary hardened after the first attack, the second one came in through a door it does not directly control.
Why a notice system is critical infrastructure
Notice systems do not get much attention, and that is the problem. Bankruptcy runs on notice: the people involved in a case need to be told what is happening in it. When the system that produces and sends those notices stops, the court can keep working, but the people who depend on that output stop hearing from it. The outage does not have to touch a single case file to cause real harm. It only has to stop the flow.
Third-party risk programs often miss this. They rank vendors by how much sensitive data they hold. They less often rank vendors by how much of a business process stops when the vendor goes dark. By the first measure a notice service can look low risk. By the second it is critical.
The RedEye take
Outsourcing a function does not outsource the risk. The AOUSC's name is on the outage, the courts carry the operational hit, and the public sees a federal court service offline. BAE's contract covers running the system. It does not move the accountability anywhere else.
We also think "isolated to the BNC system" deserves care. It may well turn out to be accurate, and containing an incident to one system is a good result. But it is an early statement made before the cause, timeline and data impact have been disclosed. Security leaders reading vendor statements during their own incidents should treat that kind of wording as a working hypothesis, not a finding.
The biggest point is concentration. One contractor ran several public-facing services for the Judiciary, and one incident took them all down together. That is not a BAE problem or a court problem in particular. It is the default way most organizations buy managed services, and most of them have not tested what happens when the vendor fails.
A security vendor, an IT outsourcer or a managed service provider is a dependency, not just a supplier. Any organization that hands a core function to one outside party has made a decision about availability, whether it meant to or not.
What defenders should learn
- Rank vendors by what stops, not just by what they store. A service that holds little sensitive data but carries a process the public relies on, like court notices, belongs in your highest risk tier.
- Map which services share one vendor. Four Judiciary sites and services went down together because one contractor ran them. Know which of your public-facing services fail together if one provider has an incident.
- Write contracts for the bad week, not the good year. Incident notice timelines, the right to forensic findings, restoration commitments and clear communication duties should be agreed before an incident, because you will not get better terms during one.
- Treat early vendor scoping statements as provisional. Words like "isolated" and "contained" are where an investigation starts. Hold your own disclosures and risk decisions until the vendor's findings are in writing.
- Track repeat incidents as one risk story. The Judiciary has now had a direct attack in 2025 and a third-party incident in 2026. Boards and leadership should see that trend together, not as two unrelated events.
Where this goes next
The open questions are the ones that decide how serious this is: how the attacker got in, how long they were there, whether any data left the BNC environment, and when notices will flow again. RedEye will update this analysis as the AOUSC and BAE release more. Source: BleepingComputer, "BAE Systems cyberattack disrupts US federal court operations," October 16, 2026.
Questions about your exposure?
RedEye Security provides assessments for organizations that need to understand their real risk.
Talk to us