BAE Systems cyber incident stops US bankruptcy notices; courts diverge on deadlines

A notice system stopped, while cases continued

A 15 October statement from the Administrative Office of the US Courts says BAE Systems has been affected by a cybersecurity incident that disrupted the Bankruptcy Noticing Center (BNC). BAE operates the system that produces and transmits notices for federal bankruptcy courts across the United States. The national office says notice production and distribution have halted, along with access to four related services. It says BAE is investigating and working to restore operations.

This is more specific than a generic report that “the courts were hacked”. The confirmed disruption is to a contractor-operated noticing service. The district notices checked for this briefing say courts continue to accept filings and open cases. They do not establish that the courts’ own case filing systems were compromised. The immediate risk is a separation between a document being filed, a notice being generated, and the person entitled to notice actually receiving it.

The dated record

Dates are dates stated by the courts, not inferred intrusion dates.

Date	What was made public	What it does not establish
9 October	The Eastern District of Texas says BAE notified the Administrative Office late that Friday of a disruption to BNC processing and associated sites.	When an attacker first gained access, or when any data was affected.
13 October	The Eastern District of California issued General Order 26-06. District courts, including the Eastern District of Texas, posted outage notices.	That every district has adopted the same relief.
14 October	The District of New Jersey says its chief judge signed a general order on the interruption.	The content of every court order nationwide.
15 October	The Administrative Office described a BAE Systems cybersecurity incident and the nationwide BNC effect.	An identified attacker, exploit or confirmed theft.
16 October	This briefing checked the central notice and district records.	A restoration date or complete count of undelivered notices.

The Eastern District of Texas notice supplies the earliest public date in this record: BAE notified the Administrative Office late on 9 October. The national 15 October statement supplies the cybersecurity characterisation. These are different events and should not be collapsed into a single “attack on 15 October” claim.

Which part of the process failed?

The BNC sits in the delivery path for electronic and paper bankruptcy notices. The Eastern District of Texas says court polling and certification drop-off processes were interrupted. The national office lists bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov and the National Creditor Registration Service among unavailable services. The latter supports access to address labels, commonly called the mailing matrix, for CM/ECF users.

Court notices distinguish service delivery from filing and separate electronic filing notices.

Function	Documented status	Source boundary
BNC production and distribution	Halted in the national statement.	This is the contractor-operated notice path.
BNC-related websites and registration	Unavailable in the national statement.	The four services are specifically named; do not generalise to every court system.
New filings, case opening and document processing	Continue in the New Jersey and Northern Texas district notices.	A case can progress while service of a notice is delayed.
CM/ECF Notice of Electronic Filing email	Eastern California says its NEF email system continues normally.	NEF is not a substitute for every BNC-generated notice or recipient.
Mailing matrix access	New Jersey and Northern Texas describe disruption and local alternative procedures.	An alternative creditor list can omit other interested parties.

In New Jersey, the court tells CM/ECF users how to query a case’s creditor list while the normal mailing matrix is unavailable. It explicitly warns that this list does not include everyone entitled to service, including debtors, trustees and the US Trustee. That is the operational trap: restoring access to a list is not proof that a notice reached every required party.

Court orders address the same outage differently

The Eastern District of California’s General Order 26-06, dated 13 October, says no party should be prejudiced by failing to respond to a notice that was not served because of the interruption, subject to law and further court order. It says the court may extend or reset deadlines or continue hearings on request or on its own initiative where permitted. Scheduled hearings proceed unless the court orders otherwise.

The Northern District of Texas says courts continue to accept filings and may extend or reset deadlines or hearings where reasonable and necessary. The Western District of North Carolina says it has not adopted a district-wide administrative order and will address problems case by case on an appropriate motion. These notices support a narrower conclusion than “all bankruptcy deadlines are paused”: treatment depends on the relevant court and case.

Stated, and still not stated

The incident description is narrower than the disruption description.

Question	On the record	Not on the record in the sources checked
Who was affected?	A BAE-operated national bankruptcy notice service and its dependent sites.	A count of cases, recipients or delayed notices.
What happened technically?	The Administrative Office calls it a cybersecurity incident; BAE is investigating.	Entry vector, malware, ransomware, persistence or attacker identity.
Was information stolen?	The public notices describe service unavailability.	A confirmed data theft, categories of exposed data or exfiltration finding.
Are filings down?	The district notices checked say filings and case opening continue.	A guarantee that every local system has no separate issue.
When will service resume?	BAE is working to restore operations.	A confirmed restoration time or complete backlog plan.

A court notice is good evidence for court operations. It is not a forensic report. On the public material checked here, it would be premature to label the event ransomware, assign it to a threat group, or state that bankruptcy records were stolen. Likewise, calling the courts “shut down” would hide the important fact that filings and hearings can continue while notification fails.

What parties and defenders should check

These are operational checks drawn from the failure mode in the court notices, not a claim that any particular BAE control failed. The court’s local orders govern case procedure.

The question that exposes the gap

For every notice the BNC should have produced since 9 October, can the responsible court establish which recipients were served, which notices remain in a queue and which deadlines may have been affected? A filing on the docket, a generated notice and delivery to every required party are three different records. The New Jersey court’s warning about its substitute creditor list shows why a local workaround cannot by itself answer that question.

Six calendar days separate the late-9 October disruption report in the Eastern District of Texas notice from the Administrative Office’s 15 October cybersecurity statement (derived from the dates in those sources). That interval measures the public record between two disclosures. It does not establish whether or when unauthorised access occurred, whether information was taken, or how many notices failed to arrive.

The next evidence that would change this account is a verified service-restoration date, the size and age of the undelivered-notice backlog, a reconciliation of recipients after resumption, and BAE’s findings on cause and data impact. None appears in the seven primary notices and orders checked for this briefing. Sources were read on 16 October 2026; parties with a live case should use their own court’s current notice and docket because orders can change during an active interruption.