MediumII Cyber Warfare & Critical Infrastructure15 October 2026, Thursday
Cyberattack on BAE Systems halts US bankruptcy court notices
The Administrative Office of the US Courts said on 15 October that the Bankruptcy Noticing Center, run by BAE Systems on behalf of the judiciary, was down because of a cybersecurity incident. Notice production for every federal bankruptcy court has stopped.
According to the Administrative Office's 15 October notice, systems operated by BAE Systems IT were affected, along with 4 web services: bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov and the National Creditor Registration Service. The centre generates notices for every federal bankruptcy court in the US and sends them by post and electronically. The notice gives no date for restoring service and offers no guidance on deadlines, meaning the windows for creditors to object and file claims.
A BAE spokesperson told The Record that the incident was confined to this system. The courts did not answer whether data had been stolen; the attacker's identity and the start date of the attack could not be verified. This is the second contractor-related public-sector outage in recent weeks. On 14 October the Department of Transportation said a security agency's call centre had shut after an attack on a contractor. According to The Record, the data of more than 1.3 million people also leaked from Arizona's state courts a few weeks earlier.
Talay assessment
Bottom line
The attack shows that the US judiciary's centralised noticing system, dependent on a single contractor, is a single point of failure. Because bankruptcy proceedings run on notice deadlines, a prolonged outage would affect creditor rights and case calendars. The most likely path is a partial restart within days and deadline extensions from the courts; whether data was exfiltrated remains unclear.
Likely effects
- Bankruptcy proceedingsNegativeWeeks
With notice production halted across all federal bankruptcy courts, creditors learn of meetings and objection deadlines later; courts may be forced to extend deadlines.
- Defence contractorsNegative1–6 months
The incident in BAE Systems' government IT business lays the ground for tighter cyber audit requirements on contractors.
- Personal dataNegative1–6 months
The centre handles debtor and creditor address data; if it was stolen, fraud risk rises, though this has not yet been verified.
Possibilities, ranked
- 1Partial restart, extended deadlines55%
Systems partly return within days and courts extend notice deadlines by general order.
Watch: A restart notice from the Administrative Office and general orders from bankruptcy courts
- 2Data breach confirmed30%
The BAE investigation shows data was exfiltrated, triggering notification obligations.
Watch: A data breach notification from BAE Systems or the Administrative Office
- 3Prolonged outage15%
The outage lasts for weeks and courts have to send notices manually or through an alternative provider.
Watch: Courts directing filers to approved alternative noticing providers
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Bankruptcy notice output▼ halted