"Bankruptcy notices are the machinery of due process," Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity at Suzu Labs, said, framing the stakes after a cyber incident that knocked a contractor’s noticing platform offline.
Administrative Office of the U.S. Courts: BNC systems taken offline
The Administrative Office of the U.S. Courts reported that a cybersecurity incident against government contractor BAE Systems has taken down "all access to the BNC systems and websites that BAE operates on behalf of the judiciary and the related bankruptcy noticing process." As a result, the Bankruptcy Noticing Center’s production and distribution of bankruptcy notices has been halted.
The bankruptcy calendar and Section 341 notices
Krell emphasized how central those notices are to case flow: the "Section 341 meeting notice opens the window for creditor claims, deadlines attach to service of every order," and he said that "since October 9 those clocks have been frozen nationwide while BAE Systems investigates a cyber incident that took the Bankruptcy Noticing Center offline." In short, the mechanism that starts and times many procedural rights in bankruptcy cases has been interrupted.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadJudges' response: extending deadlines and continuing hearings
According to Krell, judges have begun compensating for the outage by "extending deadlines and continuing hearings district by district." He noted the paradox that, while "the outage never touched a courtroom, yet it rewrote the calendar of every bankruptcy case in the country," illustrating how an external vendor’s technology can determine the procedural tempo of federal courts even without disrupting in-court proceedings.
What this means for judges, procurement managers, and security teams
- Judges and court administrators: Expect continued piecemeal relief at the district level — extensions and continuances — until the Bankruptcy Noticing Center’s service is restored, because the production and service mechanism that sets many deadlines is offline.
- Procurement managers for the courts: Krell argues the Administrative Office should "write continuity requirements into the next BAE contract as strict as the ones the courts impose on themselves," pointing to a policy gap where a single vendor provides load-bearing infrastructure without a mandated alternate path.
- Technologists and security teams: Incident response will focus first on restoring notice production and distribution; teams will also need to assess why the noticing architecture lacked an alternate path and how to harden continuity in future contracts and implementations.
Cloud, SaaS and AI: John Strand on systemic interconnectedness
John Strand, Owner of Black Hills Information Security, framed the BNC outage in broader technological terms. He argued the story "highlights how unbelievably interconnected business and government processes actually are," and criticized an outdated perimeter view of security — the idea that one defends an internal network and keeps the outside out. Strand pointed out that "modern large organization[s]... have multiple SaaS platforms, third-party integrations, and customer data flowing in and out of systems they don't own or control," making the perimeter "a lot messier than people want to believe."
Strand warned the security community is behind on risks introduced by cloud and SaaS adoption and added that "now we’re adding AI to the mix, giving attackers new ways to target those services and exploit the connections between them. We weren’t caught up before. We’re certainly not ready now." His comments place the BAE/Bankruptcy Noticing Center outage in a category of incidents where service dependencies, third-party platforms, and emerging attack vectors converge to produce outsized operational effects.
Restoring the Bankruptcy Noticing Center’s service is, in Krell’s words, "the urgent job." The incident leaves a concrete procurement question in its wake: why a single vendor pathway for nationwide noticing had no alternate route, and whether contract terms should be revised to require continuity guarantees as strict as the courts expect of themselves. Until those operational and contractual gaps are addressed, the judiciary will remain vulnerable to outages that do not enter courtrooms but nevertheless rewrite the procedural calendar nationwide.
https://www.securitymagazine.com/articles/102664-security-leaders-discuss-bae-cyberattack
