The courts didn’t get hacked. Their supplier had a problem, and the courts’ work stopped anyway. Here’s the story, and a plan, with no daft jargon.
What happened?
The Bankruptcy Noticing Center (BNC) produces and sends bankruptcy notices for all federal bankruptcy courts in the US. BAE Systems runs the BNC’s systems and websites on behalf of the federal judiciary (US Courts). Its spokesperson says the operator is BAE Systems, Inc. (The Register).
Late on Friday 9 October, BAE told the Administrative Office of the US Courts about a service disruption affecting the systems that process notices and four websites (US Bankruptcy Court, E.D. Texas). Courts posted notices on 13 October calling it a disruption or interruption, without mentioning a cyber incident (SecurityWeek). On 15 October the Administrative Office said BAE’s IT and the BNC websites had been “impacted by a cybersecurity incident” (US Courts).
What stopped: the BNC’s production and distribution of notices, and access to bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov and the National Creditor Registration Service (US Courts). Paper and electronic notices have not gone out since 9 October (CyberScoop).
What still works: courts are still accepting filings, opening cases and processing documents, and the court system’s own Notice of Electronic Filing emails are still reaching registered users (US Bankruptcy Court, S.D. Florida).
Knock-on effects: filers can no longer pull the usual creditor mailing list. Courts published a manual workaround using searches in their filing system, but warned the results may miss addresses registered through the BNC’s own services (US Bankruptcy Court, S.D. Florida).
Courts improvising: courts have issued orders letting judges extend or reset deadlines and continue hearings (US Bankruptcy Court, N.D. Texas). One encouraged attorneys to give “direct, temporary notice” on urgent matters (US Bankruptcy Court, S.D. Alabama), and another extended the automatic stay by 30 days in some cases (The Register) (E.D. Texas).
What BAE has said
A BAE Systems spokesperson told several outlets: “We are aware of a security incident that is isolated to the BNC system and have taken immediate steps to address it. We are coordinating closely with AOUSC on the response” (BleepingComputer) (Infosecurity). CyberScoop also quotes: “No other systems have been affected” (CyberScoop). We found no statement on BAE’s own website; its comments have reached the public through reporters.
What’s confirmed, what isn’t, and what we infer
Confirmed: a cybersecurity incident hit BAE-run BNC systems; notices have stopped nationwide since 9 October; the BNC websites are unavailable; and BAE is investigating and working to restore operations (US Courts) (CyberScoop).
Not known (as of 19 October): what caused it or whether it was a cyberattack, and whether any data was compromised, as neither the judiciary nor BAE has said (SecurityWeek); who is behind it, with no group named (CyberScoop); and when service will return, with no date given (Infosecurity). Some headlines say “cyberattack”, but the judiciary’s own words are “cybersecurity incident” (US Courts). The US cyber agency CISA referred questions to the US Courts, and the FBI didn’t respond (The Record). When we tried the three BNC websites on the morning of 19 October, none responded.
What we infer (our view, not the investigators’): one supplier, running one system, sat in the middle of a process every bankruptcy court relies on. Some recipients were even required to use it: anyone mailed 25 or more paper notices in a month can be moved to electronic-only notices held in an account hosted by the BNC (US Courts). When that one link broke, there was no ready-made second route, so each court had to work one out.
Why this matters to a small business in Grimsby
You probably don’t use the BNC. But you almost certainly rely on suppliers in the same way: a card machine provider, cloud accounting or payroll, a hosted phone system, an email provider, an online booking or ordering system, your bank’s payment service. If one of them goes down, your customers won’t care whose fault it is. The NCSC puts it simply: a vulnerable supply chain “can cause damage and disruption”, and very few UK businesses set minimum security standards for their suppliers (NCSC).
1. Know which critical processes depend on third parties
Write down the five or six things your business must keep doing every day: taking payments, invoicing, paying staff, answering the phone, sending quotes, getting orders out. Next to each, list every supplier it needs. For the courts, “send notices” turned out to depend entirely on one contractor.
2. Map supplier dependencies, including your suppliers’ suppliers
Your accounts package may run on someone else’s cloud, and your IT provider may use other tools to reach your systems. The NCSC’s supply chain guidance sets out 12 principles, starting with understanding the risks (NCSC). Under UK GDPR, a processor handling personal data for you needs your written authorisation before using a sub-processor, and must tell you about intended changes (ICO).
3. Have a manual fallback, and know its limits
The courts fell back on manual searches and asking lawyers to serve notices themselves, and warned that the manual lists might miss people (US Bankruptcy Court, S.D. Florida). Do the same thinking before you need it: how would you take payment, find a customer’s phone number or issue an invoice if a key system was down for a week? Write it into a short business continuity plan, then rehearse it. The NCSC’s free Exercise in a Box includes supply chain exercises and doesn’t need an expert to run (NCSC).
4. Ask your suppliers about their incident response
The NCSC’s supplier assurance questions are a good script. They include: does the supplier have plans to cope with and recover from an incident, and “what business continuity / disaster recovery plan does the supplier have for maintaining minimum service levels to you” (NCSC)? Ask how they’ll tell you about a problem, and how quickly. BAE first reported “a service disruption” (E.D. Texas), and the words “cybersecurity incident” only appeared publicly on 15 October (CyberScoop).
5. Put supplier risk in your contracts
The NCSC asks whether your contract “clearly state[s] requirements for managing and reporting incidents, including reporting timescales, who to report to, and expected actions” (NCSC). Where a supplier processes personal data for you, UK GDPR requires a written contract covering security, sub-processors, help with breach notification, and audits (ICO). If that supplier suffers a breach it must tell you without undue delay, and a notifiable breach must reach the ICO within 72 hours of you becoming aware of it. That includes loss of availability, not just theft (ICO).
6. Keep backups and copies you control
If a supplier holds your only copy of something, their outage takes it away from you. Keep your own export of key data, such as customer contacts, invoices and stock lists, and follow the NCSC’s 3-2-1 rule: at least 3 copies, on 2 devices, and 1 offsite, with at least one backup offline (NCSC).
Your supplier dependency checklist
- List your critical processes, the five or six things you must keep doing every day.
- Map every supplier behind each one, including the ones your suppliers rely on.
- Write a manual fallback for each critical process, and rehearse it.
- Ask key suppliers about their incident response and continuity plans.
- Check contracts for incident reporting timescales and UK GDPR processor terms.
- Keep your own copies, with a 3-2-1 backup and at least one copy offline.
References
- SecurityWeek, “BAE Systems Security Incident Stalls Notices From US Bankruptcy Courts”, 16 Oct 2026
- Administrative Office of the US Courts, “Cybersecurity Incident Disrupting Bankruptcy Court Operations”, 15 Oct 2026
- The Register, “Attack on BAE-managed system disrupts US bankruptcy courts”, 16 Oct 2026
- US Bankruptcy Court, Eastern District of Texas, “BNC Service Disruption Notification”, 13 Oct 2026
- CyberScoop, “Cybersecurity incident at BAE Systems disrupts US bankruptcy court system”, 16 Oct 2026
- US Bankruptcy Court, Southern District of Florida, “Important Update Regarding Bankruptcy Noticing Center Disruption in Service”
- US Bankruptcy Court, Northern District of Texas, “BNC Service Interruption Update”, 15 Oct 2026
- US Bankruptcy Court, Southern District of Alabama, “Important Updates Regarding Bankruptcy Noticing Center Disruption in Service”
- US Bankruptcy Court, Eastern District of Texas, “General Orders” (General Orders 26-1 and 26-2, 14 Oct 2026)
- BleepingComputer, “BAE Systems cyberattack disrupts US federal court operations”, 16 Oct 2026
- Infosecurity Magazine, “Cyber Incident at BAE Systems Disrupts US Federal Bankruptcy Noticing”, 16 Oct 2026
- The Record, “Federal bankruptcy courts dealing with outages after contractor cyberattack”, 15 Oct 2026
- US Courts, “Bankruptcy Noticing”
- National Cyber Security Centre, “Supply chain security guidance”
- Information Commissioner’s Office, “What needs to be included in the contract?”
- National Cyber Security Centre, “Exercise in a Box”
- National Cyber Security Centre, “Supplier assurance questions”
- Information Commissioner’s Office, “Personal data breaches: a guide”
- National Cyber Security Centre, “Offline backups in an online world”, blog post
Need a hand applying any of this to your business? Get in touch — call +44 1472 564538 or email services@msl.org.uk.