Full Report
The Administrative Office of the US Courts says a cyberattack on government contractor BAE Systems has taken down the notice system used by federal bankruptcy courts. [...]
Analysis Summary
# Incident Report: BAE Systems Cyberattack Disrupts US Bankruptcy Noticing Systems
## Executive Summary
A cyberattack on BAE Systems, a government contractor that operates bankruptcy noticing systems for the federal Judiciary, made the Bankruptcy Noticing Center (BNC) and related services unavailable. The Administrative Office of the US Courts said the outage also halted production and distribution of bankruptcy notices. As of the source reporting, BAE was still investigating and working to restore operations, and no root cause, threat actor, or data-compromise details had been disclosed.
## Incident Details
- **Discovery Date:** Not disclosed. The Administrative Office of the US Courts published its notice on October 15, 2026.
- **Incident Date:** Not disclosed.
- **Affected Organization:** BAE Systems (contractor operating systems on behalf of the federal Judiciary). Impacted courts are referenced but not named.
- **Sector:** Government / Federal Judiciary; defense and IT contracting
- **Geography:** United States (federal bankruptcy courts). BAE Systems is headquartered in the UK.
## Timeline of Events
### Initial Access
- **Date/Time:** Not disclosed
- **Vector:** Not disclosed
- **Details:** The source does not describe how the attackers gained access.
### Lateral Movement
- Not disclosed in source.
### Data Exfiltration/Impact
- **Confirmed impact:** Access to the following systems and services was unavailable:
- BNC systems and websites operated by BAE on behalf of the Judiciary
- bnc[.]uscourts[.]gov
- bankruptcynotices[.]uscourts[.]gov
- notices[.]uscourts[.]gov
- National Creditor Registration Service
- **Operational impact:** Production and distribution of bankruptcy notices were halted.
- **Data impact:** Not disclosed. The source does not say whether data was stolen or altered.
### Detection & Response
- **Detection:** Not described in source.
- **Response actions taken:**
- The Administrative Office of the US Courts communicated with the impacted courts.
- It coordinated with BAE Systems.
- BAE is "actively investigating this incident and working to restore operations."
- The Administrative Office published a public notice on October 15, 2026.
## Attack Methodology
The source does not describe attacker techniques. The following fields are unknown:
- **Initial Access:** Not disclosed
- **Persistence:** Not disclosed
- **Privilege Escalation:** Not disclosed
- **Defense Evasion:** Not disclosed
- **Credential Access:** Not disclosed
- **Discovery:** Not disclosed
- **Lateral Movement:** Not disclosed
- **Collection:** Not disclosed
- **Exfiltration:** Not disclosed
- **Impact:** Service disruption. The attack made the noticing systems unavailable, but the method is unknown.
**Background context (not confirmed as related):** The article notes that the Judiciary disclosed a separate cyberattack in 2025 against its electronic case management systems. Politico reported at the time that hackers breached CM/ECF and PACER and accessed sensitive data, including the identities of confidential informants. The Judiciary said it was adding stricter access controls for sealed filings. The source does not link that incident to the current BAE attack.
## Impact Assessment
- **Financial:** Not disclosed
- **Data Breach:** Not confirmed. The source does not indicate any data theft.
- **Operational:** High for the affected services. Bankruptcy notice production, distribution, and related web services were down. Affected courts and parties may face delays in notices, and the duration of the outage is unknown.
- **Reputational:** Public disclosure by the Administrative Office and coverage by BleepingComputer. Both BAE Systems and the Judiciary were unavailable for comment at the time of the original reporting. The incident adds to concern about the Judiciary's cybersecurity posture following the 2025 breach.
## Indicators of Compromise
The source provides no technical IOCs (IP addresses, file hashes, malware names, or threat actor infrastructure).
- **Network indicators:** None disclosed. Affected service domains are listed above for monitoring and status checks only.
- **File indicators:** None disclosed.
- **Behavioral indicators:** None disclosed.
## Response Actions
- **Containment measures:** Not specified. The affected services were taken offline or became unavailable, but the source does not say whether this was a deliberate containment step.
- **Eradication steps:** Not disclosed.
- **Recovery actions:** BAE Systems is "working to restore operations." No timeline has been given.
## Lessons Learned
- **Third-party risk is a single point of failure.** Critical judicial functions relied on one contractor. A compromise there halted nationwide notice processing.
- **Dependency mapping matters.** Agencies should know which contractor systems support time-sensitive legal processes and plan for their loss.
- **Prior incidents raise the bar.** Following the 2025 CM/ECF and PACER breach, expectations for vendor security and resilience are higher.
- **Public communication was prompt but limited.** The Judiciary issued a notice quickly, but key facts (scope, cause, data exposure, and restoration timeline) remain unknown.
*Note: Several items above could not be determined from the source article and should be verified against official updates from the Administrative Office of the US Courts and BAE Systems.*
## Recommendations
- **Vendor security requirements:** Require contractors that operate public-facing judicial systems to meet strict security baselines, with regular audits and evidence of controls.
- **Redundancy and continuity:** Build backup notice-distribution pathways (alternate vendors, manual or fallback processes) so court operations continue during a contractor outage.
- **Incident notification clauses:** Require contractors to report incidents to the agency quickly and to share technical details that help affected courts respond.
- **Access controls and monitoring:** Enforce least-privilege access, MFA for administrative accounts, and monitoring for anomalous activity in contractor-managed environments.
- **Tested recovery plans:** Regularly exercise restoration procedures for noticing and case management systems, including restoration timelines and priority ordering.
- **Information sharing:** Share IOCs and attack techniques across the Judiciary, contractors, and relevant federal partners once they are confirmed, so other systems can be checked.
- **Monitor official updates:** Track the Administrative Office's notices and BAE Systems' statements for root-cause findings and restoration status.