Before and After a Contractor Breach: How a BAE Systems Incident Halted Federal Bankruptcy Notices
A cyberattack on BAE Systems knocked the Bankruptcy Noticing Center offline for every federal bankruptcy court. Here is how the process worked before the incident, what stopped, and what is still unknown.
Federal bankruptcy courts do not print every notice in-house. They lean on a shared service run by a contractor. This week that handoff became the story.
The details below come from The Record’s report on the Administrative Office of the U.S. Courts statement and BAE’s response.
Before: a shared noticing pipeline
- BAE Systems operated the Bankruptcy Noticing Center (BNC) for the judiciary.
- The BNC produced and transmitted bankruptcy notices for all federal bankruptcy courts.
- Related sites and services included bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service.
After: notices stop, sites go dark
- On Thursday afternoon the Administrative Office said a cyberattack on BAE disrupted the BNC.
- All access to the BNC systems and websites BAE runs for the judiciary, and the related noticing process, was unavailable.
- Production of bankruptcy notices halted.
- BAE said the security incident was isolated to the BNC system and that it had taken immediate steps and was coordinating with the Administrative Office.
What is still unclear
The Administrative Office did not say what kind of attack it was or whether data was stolen. CISA pointed The Record back to the courts; the FBI did not comment. The Record notes the timing lands weeks after Arizona’s state court breach (more than 1.3 million people) and after other recent federal contractor disruptions, including a Department of Transportation safety-agency contact center taken offline after a contractor incident on Wednesday.
What this means for your company
Even if you never file a bankruptcy notice, the same pattern shows up in small and mid-size businesses: payroll, email filtering, document signing, or backup consoles that live at a vendor. When that vendor is hit, your process stops whether or not your own servers were touched. Map which outside platforms you depend on for daily operations, ask how you will work if they go offline for a week, and keep an eye on contract language about breach notice and continuity. Courts and companies both learn the hard way that “someone else hosts it” is not the same as “someone else absorbs the risk.”
Need help mapping vendor dependencies and a short outage plan for the systems you cannot run without? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
