Emerging ThreatsData Breaches

BAE Systems Breach Disrupts US Bankruptcy Court Notices

Analyst 207||Source: CyberScoop
Federal bankruptcy court building entrance with somber atmosphere and people in background.

"We are aware of a security incident that is isolated to the BNC system and have taken immediate steps to address it," a BAE Systems spokesperson told CyberScoop.

Scope: BNC websites taken offline and notice production halted

A cybersecurity incident at BAE Systems has halted the production and delivery of bankruptcy notices for every federal bankruptcy court in the United States, according to the Administrative Office of the U.S. Courts. The Bankruptcy Noticing Center (BNC), which produces and transmits notices in bankruptcy cases nationwide and is operated on behalf of the federal judiciary by BAE Systems, has had its information technology and supporting websites taken offline.

The disruption has affected multiple URLs, including bnc.uscourts.gov, bankruptcynotices.uscourts.gov and notices.uscourts.gov, and has also taken the National Creditor Registration Service offline. The BNC stopped the production and distribution of notices, paper and electronic, on Oct. 9; as of Friday the affected websites remained offline.

Federal bankruptcy courts' operations: filings continue, per Clerk of Court Joe Falzone

Despite the outage, court operations have not stopped. Clerk of Court Joe Falzone said courts are still taking new filings, opening cases and processing paperwork. The Administrative Office said it has been in communication with the affected courts as BAE Systems continues its investigation.

For parties that must serve documents, Falzone’s guidance is procedural and limited: people can look up creditor and party addresses by running searches in the courts’ electronic filing system, then compare the two lists to make sure nothing is missing. The Administrative Office cautioned, however, that those lists might not include addresses that people registered through the BNC’s Electronic Bankruptcy Noticing program or the National Creditor Registration Service, and as a result some intended recipients of notice might not appear in the available records.

Investigation status: statements from the Administrative Office and BAE Systems

The Administrative Office of the U.S. Courts published a statement on Oct. 15 that explicitly described the situation as a cybersecurity incident affecting BAE’s IT and the websites supporting the center’s operations. Earlier in the week, a note posted Tuesday on the U.S. Bankruptcy court website described a “nationwide service interruption” without mentioning cyberactivity; the Oct. 15 statement was the first to use the words cybersecurity incident.

Neither the Administrative Office nor the earlier court notice identified a cause, said whether information was accessed, or gave an estimate for restoration. BAE Systems told CyberScoop that the incident is “isolated to the BNC system” and that it has “taken immediate steps to address it,” adding that “No other systems have been affected.” The Administrative Office said BAE is investigating and working to restore operations.

What this means for technologists, bankruptcy court clerks, and creditors registered with the BNC

  • Technologists and security teams: BAE Systems has acknowledged a security incident limited to the BNC system and is investigating; technical teams will be watching restoration activity on the specific BNC-hosted sites (bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov) and the National Creditor Registration Service as they come back online and will need to verify integrity before resuming automated notice flows.
  • Bankruptcy court clerks and court administrators: Courts can continue to accept filings and open cases, but clerks must rely on electronic filing searches and manual checks to identify parties and creditors until BNC services are restored; they will also need to track registrations submitted via the BNC’s Electronic Bankruptcy Noticing program that may be missing from local lists.
  • Creditors and parties registered with the BNC or the National Creditor Registration Service: Notices intended for some recipients may not be produced or distributed while the BNC is offline. Parties that rely on BNC registration for receiving official notice should confirm addresses via the courts’ electronic filing system and prepare for possible delays or gaps in mailed or electronic notices.

Context: a prior judiciary breach and unanswered operational questions

The BNC outage is the second incident in as many years to affect U.S. Courts: in 2025 there was a major breach of the federal judiciary’s electronic case filing system. Beyond that context, key operational questions remain unanswered by the Administrative Office and BAE Systems statements: the cause has not been identified publicly, no determination has been released on whether information was accessed, and there is no announced date or timetable for full restoration of BNC services.

The immediate picture is therefore twofold: bankruptcy courts can continue core case intake and local processing, but the central production and distribution pipeline for nationwide notices — run by BAE Systems on behalf of the judiciary — is offline with an ongoing investigation and no clear timeline for resumption. The Administrative Office and BAE Systems are the named actors handling the response; their next public updates will determine how quickly notice delivery and the related registration services can be restored.

Source: https://cyberscoop.com/bae-systems-cybersecurity-incident-us-bankruptcy-courts/

Emerging ThreatsGovernment ServicesSupply ChainBAE SystemsCybersecurity IncidentUS Bankruptcy CourtFederal JudiciaryBankruptcy Noticing CenterAdministrative Office Of The U.S. CourtsNotice Production Disruption
Related Intelligence

Continue Reading

Blurred server rack in a brightly-lit tech facility.

Chinese hackers exploit BeyondTrust zero-day in espionage push

Chinese hackers have been exploiting a critical zero-day vulnerability in BeyondTrust Remote Support, first detected on August 29, in a sophisticated espionage campaign attributed to the threat group Armory Castle. A patch was released on October 8 to fix the defect, tracked as CVE-2026-102764.

Analyst 207
Network router on a rack with multiple cables and surrounding equipment in a dimly lit server room.

Unit 42 Threat Intel Exposes Top Vectors for Initial Access Attacks

Cyber attackers are exploiting weaknesses in public-facing systems and using stolen credentials to gain a foothold, with a growing reliance on external edge exploitation and identity compromise. This alarming trend highlights the need for robust defenses to protect against initial access attacks.

Analyst 207
Server room with rows of computer servers and networking equipment, one rack with highlighted ports centered.

Attackers Hijack AOMEI Backupper's Update Servers to Deploy Backdoor

In a shocking security breach, attackers hijacked AOMEI Backupper's update servers for just a few minutes on three separate occasions, deploying a sneaky backdoor to unsuspecting users who checked for updates during that time. This tiny window of opportunity was all the hackers needed to compromise the system, thanks to a vulnerability in AOMEI's update process.

Analyst 207
Smartphone screen with blurred ad on a table or in someone's hand, set against a neutral city or coffee shop background.

Candiru Spyware Exploits Targeted Ads for Zero-Click Attacks

Meet AdFection, a sneaky zero-click infection technique that uses targeted online ads to spread Candiru spyware, requiring just a single ad load to compromise a device. This clever exploit forms a bridge between mercenary spyware companies and the advertising ecosystem, allowing for stealthy attacks with no user interaction needed.

Analyst 207