What happened
The nationwide BNC service disruption began on October 9, 2026 and stopped the ordinary processing and delivery of electronic and paper bankruptcy notices.
On October 15, 2026, the Administrative Office of the U.S. Courts publicly identified the disruption as a cybersecurity incident affecting BAE Systems IT and BNC websites. The judiciary said it was coordinating with BAE Systems, which was investigating and working to restore operations.
Reporting on October 16, 2026 found that BNC production and distribution remained halted without a disclosed cause, data-impact assessment or restoration timetable. Courts continued accepting filings, opening cases and processing documents, but parties could not assume that court-issued notices had been delivered through the normal BNC channels.On October 18, 2026, the BNC and related websites were still reported unavailable, with no announced restoration date.The services reported as inaccessible are bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov and the National Creditor Registration Service, and the BNC has halted production and distribution of bankruptcy notices.BAE Systems operates the Bankruptcy Noticing Center’s systems and websites for all federal bankruptcy courts in the United States. That operating model turns one supplier incident into a nationwide legal-process disruption rather than a local court outage.Attribution posture: Neither the Administrative Office of the U.S. Courts nor the cited reporting names a responsible actor; responsibility remains unresolved.
Why this matters now
The outage affects a legally significant process rather than an ordinary productivity service. Creditors, debtors, trustees, law firms and internal legal teams may rely on BNC delivery to learn of cases, meetings, orders and deadlines. Courts continue processing filings, but alternate creditor lists may omit addresses registered through Electronic Bankruptcy Noticing or the National Creditor Registration Service, so a manual workaround can still leave material gaps.
This is a concentration-risk test for outsourced legal operations. One contractor-operated service supports bankruptcy noticing nationwide, and restoration timing remains unavailable. Enterprises should assume that similar single-provider dependencies exist in regulatory filing, claims administration, payroll, benefits, customer notification and records delivery. The leadership decision is whether those dependencies have named fallback owners, authoritative data sources and counsel-approved alternate procedures.
The decision for security leaders
Direct General Counsel to establish one authoritative register of active bankruptcy matters, notice obligations, responsible counsel and potentially affected deadlines. The register should distinguish documents visible on court dockets from proof that required parties received notice. Business units should not rely on ordinary email or postal delivery assumptions while the BNC remains unavailable.
Use the incident to expose hidden supplier concentration. Procurement, resilience and legal operations should identify which notification, filing and records processes depend on one external platform, then document alternate data sources, manual procedures, authority to invoke them and acceptable outage duration. Restoration should require written assurance on service integrity and known data-exposure limitations, not merely website availability.
Evidence of closure
- A counsel-approved register of affected matters, notice obligations and deadline dispositions.
- Proof of alternate service or docket monitoring for each time-sensitive bankruptcy matter.
- Written assurance stating BNC restoration scope, data-integrity validation and known exposure limitations.
- A completed dependency map for outsourced legal-notification services and fallback owners.
The Security.io assessment
The confirmed impact is operational: nationwide BNC systems and websites are unavailable and notices are not being produced or distributed. The evidence does not establish ransomware, data theft, altered court records or compromise of systems beyond the BNC environment. Those possibilities remain unresolved and should not be converted into facts.
The cited sources did not publish the intrusion vector, affected data, malware, hashes, IP addresses, domains or a restoration date. Security teams supporting legal operations therefore have no technical hunt package from the selected evidence; the immediate control is continuity, authoritative docket monitoring and supplier assurance while technical facts develop.
Attribution posture: Neither the Administrative Office of the U.S. Courts nor the cited reporting names a responsible actor; responsibility remains unresolved. Security.io’s assessment changes if authoritative sources confirm data access, notice alteration, wider BAE impact or a restoration process that requires customer-side validation.
Questions for the morning meeting
- Which active matters depend on BNC delivery for notice or deadline awareness?
- Which legally significant supplier services have no tested alternate delivery mechanism?
- What written assurance is required before normal reliance on the BNC resumes?