US bankruptcy notices halted since 9 October: BAE says 'isolated'; cause, data and end date are not stated

Seven to eight days of outage against notice windows of 14, 21 and 28 days

Courts say the Bankruptcy Noticing Center (BNC), the system that produces and sends the notices for all federal bankruptcy courts, stopped working on 9 October 2026. When this briefing was last checked, at 11:45 BST on Saturday 17 October, that was between 175 and 199 hours, or 7.3 to 8.3 days (derived: the courts give a date, not an hour, and two of them say "late on Friday, October 9"). The notice rules those courts work under count in days. An order can be appealed within 14 days (Rule 8002(a)(1)). The meeting of creditors and eight other events need at least 21 days' notice by mail (Rule 2002(a)), and the objection time for a disclosure statement or a plan needs at least 28 (Rule 2002(b)). Set against those windows, the outage so far is 52 to 59 per cent of 14 days, 35 to 39 per cent of 21 days and 26 to 30 per cent of 28 days (derived).

That arithmetic shows how much of a rule-sized window has already passed with nothing being sent, and that the figure grows by a day each day. It does not show that any deadline has been missed or any creditor harmed. A notice period runs from the day a notice is given, not from the day a system fails, and the courts have each said something about notices that were not served. Their orders differ, and the differences are most of the story below.

What the record does not establish is longer than what it does. The Judiciary calls it a cybersecurity incident and BAE Systems calls it a security incident. Neither says what happened, whether data was taken, when service will return, or how many cases, notices or deadlines are affected. BAE says the incident is isolated to the BNC system, which is BAE's claim. No source read for this briefing says that any UK service uses this system. No claim of responsibility and no CISA or FBI statement turned up: CISA's news page lists nothing after 8 October, and the FBI's press page returned a block, so it was not read.

This briefing reads the Judiciary's own release and its Bankruptcy Noticing page, the notices and orders of eleven courts, the Federal Rules of Bankruptcy Procedure and the Code sections they rest on, BAE Systems' newsrooms and regulatory news feed, and the UK texts a buyer of outsourced public-service systems would use. Press reports (BleepingComputer, The Record, Infosecurity, SecurityWeek, CyberScoop, The Register and the ABA Journal) are used as pointers and for BAE's statement, which BAE gave to reporters. Everything was read between 11:07 and 11:45 BST on Saturday 17 October 2026. One sentence on interest: BAE sells IT and security services to governments and is the party saying the incident is isolated, while the Judiciary is BAE's customer and the other party describing it. Both are treated like any party, with claims attributed and none adopted. This is not legal advice.

What the Judiciary's release says, and what it leaves to the courts

The release is dated 15 October 2026, carries no time of day and runs to three short paragraphs. It says BAE Systems IT and websites that support the BNC "have been impacted by a cybersecurity incident". It says the BNC "produces and transmits bankruptcy notices for all federal bankruptcy courts around the country" and that BAE "operates BNC systems and websites on behalf of the Federal Judiciary". The Administrative Office of the U.S. Courts (AOUSC) says it is in communication with the impacted courts and coordinating with BAE, which is "actively investigating this incident and working to restore operations".

The scope sentence is the one that matters: "all access to the BNC systems and websites that BAE operates on behalf of the judiciary" and the related noticing process are "unavailable at this time", including three named websites and the National Creditor Registration Service (NCRS). That is four named items (derived: three websites and one service), and the word "including" means the list is not stated to be complete. The release adds that the incident "halted the BNC's production and distribution of bankruptcy notices". The Judiciary's Bankruptcy Noticing page carries a "Service Disruption" banner that points to the release. At 11:20 BST and again at 11:43 BST on 17 October the release was unchanged, and the Judiciary's news list showed nothing newer.

One observation from this desk, which is not a Judiciary statement: at 11:19 BST and again at 11:43 BST on 17 October a public DNS resolver returned a server failure for all three named hostnames. That is consistent with the sites being unavailable and says nothing about cause.

What the release does not say, and so leaves to the courts, to BAE or to nobody:

• a start date or time;
• a cause;
• whether any data was accessed or taken;
• a date for restoration;
• a count of courts, cases or notices: it says "all", and the Judiciary's own About page puts the number of bankruptcy courts at 90;
• anything about deadlines;
• how an affected party should be told.

The timeline: four days to the first court notice, six to the Judiciary's release

What is on the record, day by day. Courts' own notices and orders are primary; press is marked as such. Day counts are derived in calc.py.

Date (2026)	What is on the record	Read from
Fri 9 Oct	Courts say the disruption began on 9 October. Two (W.D. Ky., D. Wyo.) say it was reported late on Friday, October 9; W.D. Tenn. says the BNC alerted the court that day. SecurityWeek, citing the E.D. Tex. court, says BAE first told the Administrative Office late that day.	Court notices; SecurityWeek (press)
Sat 10 to Mon 12 Oct	A weekend, then a federal holiday that courts list as a closure (for example D. Ariz. and E.D. Wis.). No BNC notice dated these days turned up in a scan of court home pages, which is a loose test.	Court home pages; scan in sources
Tue 13 Oct	First court notices found, headed service disruption or interruption (S.D. Ohio, N.D. Ala., S.D.N.Y. and others). S.D. Ohio: notices entered on or after 7 October "appear to be affected" and it "may take multiple days to resolve". N.D. Ala. names BAE. SecurityWeek says none of the 13 October notices mentioned a cybersecurity incident.	Court notices; SecurityWeek (press)
Wed 14 Oct	Orders signed in E.D. Tex. (26-1, 26-2), S.D.N.Y. (M-678), D.N.J., W.D. Tenn. (26-0003) and C.D. Cal. (26-02).	Court orders
Thu 15 Oct	The Judiciary's release, with no time stated. The Record's report, posted at 20:48 UTC (21:48 BST), is the earliest found that carries BAE's statement. CyberScoop says the release was the first use of the words cybersecurity incident. W.D. Mich.'s chief judge writes to the bar that "late last week the BNC suffered a cybersecurity incident".	Release; W.D. Mich. letter; press
Fri 16 Oct	S.D. Fla. Administrative Order 2026-06: "At this time it is unknown how long the outage may last." BAE's statement is repeated by BleepingComputer, SecurityWeek, Infosecurity, The Register and CyberScoop.	S.D. Fla. order; press
Sat 17 Oct	Release unchanged at 11:43 BST. BAE's global and US newsrooms carried no statement when read at about 11:15 BST, and its regulatory news feed (re-read at 11:43) has nothing after 12 October. CISA's news page lists nothing after 8 October.	Judiciary, BAE and CISA pages

Counted in days (derived): 9 October to the first court notice found is 4 days; 9 October to the Judiciary's release is 6; the first court notice to the release is 2; the release to the Saturday reading is 2; 9 October to the reading is 8. Of the first four days, three were a weekend and a holiday, which may account for part of the gap (inference, not stated by anyone). The earliest use of the words cybersecurity incident found in a Judiciary or court notice is the Judiciary's release, six days after the courts' start date. CyberScoop says the same, and a scan of 85 court home pages found nothing earlier, which is a loose test.

How parties are being told: three models in eight courts' orders

Where the courts address it, they say two things: they are still taking filings and opening cases (E.D. Tex., D.N.J., W.D. Mich., W.D. Tenn.), and notices of electronic filing from CM/ECF still go to registered users (S.D. Ohio, N.D. Ala., S.D. Fla., W.D. Tenn.). What stopped is the BNC's own work, the paper mail and the electronic notices to parties who are not CM/ECF users. After that the courts diverge.

Orders and notices of eight courts, read from the courts' own sites between 11:07 and 11:45 BST on 17 October 2026. Quotations are from the orders.

Court and order	What it says it does	What it does not do or leaves open
E.D. Tex., General Orders 26-1 and 26-2, 14 Oct	26-1: "No party shall be prejudiced by a failure to respond to a notice or order that was not served". The court may extend or reset deadlines or continue hearings on request or on its own initiative. 26-2: in cases filed on or after 14 September where a motion to continue the stay has been filed, the automatic stay is continued 30 more days.	Extends nothing by itself: "All scheduled hearings shall proceed unless the Court orders otherwise." 26-1 stays in effect until further order, but the court's web notice shows an expiry date of 23 October.
S.D.N.Y. General Order M-678, D.N.J. general order, W.D. Tenn. General Order 26-0003, all 14 Oct	The same three paragraphs as E.D. Tex. 26-1 (derived by comparing the texts). S.D.N.Y. adds that only orders and notices served by the court are affected, not those served by other parties.	Same limits: relief on request, hearings proceed, all "subject to applicable law".
C.D. Cal., General Order 26-02, 14 Oct	The court will not deliver entered orders by email to debtors in its electronic notice programme or by regular mail to any party. The party who lodged an order serves it on parties who are not CM/ECF users within 2 business days of entry and files proof within 3.	Silent on deadlines. Moves the work to the party who lodged the order.
S.D. Fla., Administrative Order 2026-06, 16 Oct	"Transmission of a document to the BNC for processing does not establish that notice has been given." The U.S. trustee, Chapter 7 trustees, debtors' attorneys and unrepresented debtors take over notices the clerk would have served. For cases filed on or after 7 October the debtor's side serves the commencement and meeting-of-creditors notice within 3 days.	"This Order does not extend, shorten, or alter any statutory or rule-based deadlines." Relief is by motion, case by case. "At this time it is unknown how long the outage may last."
W.D. Mich., chief judge's letter to the bar, 15 Oct	Clerk's staff serve meeting-of-creditors, commencement and Chapter 13 confirmation hearing notices. If the outage runs through the weekend, the court may ask Chapter 13 debtors' counsel from Monday 19 October to serve the plans.	No order yet: "If we need to take this step, I will issue an administrative order".
E.D. Wis., Administrative Order 26-1, 15 Oct	Titled "Authorizing Alternative Mailing Matrix Procedures During Bankruptcy Noticing Center Disruption".	The text of the order was not read; only the court's notice of it.

Three models, by this briefing's grouping: relief on request (four courts, the same words); no relief but the service work moved to others (S.D. Fla., C.D. Cal.); and the clerk taking the work on, with counsel as a fallback (W.D. Mich.). A creditor's position therefore depends on the district where the case sits. The same three paragraphs in four orders on one day suggest a shared template. Who wrote it is not stated.

The four relief orders each find good cause under Rule 9006. That rule lets a court extend a time for cause, but it also bars extensions of some times and ties others to their own rules (see the table of rules below), and the orders hedge accordingly: "subject to applicable law", "where permitted by law". An order that says no one is prejudiced is a promise about how a court will use its discretion. No source read says how it will use it.

The fallback list lacks the addresses the BNC held

The courts' common fallback is to have CM/ECF users pull the creditor list for a case and serve from it. E.D. Tex. and D.N.J. warn that the list "does not include all interested parties", such as the debtor, trustees and the U.S. Trustee. S.D. Fla. goes further: "These lists may not include addresses registered with the BNC's Electronic Bankruptcy Noticing (EBN) program or the National Creditor Registration Service (NCRS)." The rule behind that is Rule 9036(b)(2)(A): if a recipient has registered an electronic address with the Judiciary's bankruptcy-noticing programme, "the clerk must use that address".

W.D. Tenn.'s notice of 14 October adds what the outage disables, as that court reads it: the BNC cannot give noticing "through paper mailing or through electronic notices to debtors or creditors with an EBN account"; creating and updating accounts in the debtor electronic noticing programme is suspended; and anyone requesting the list of creditors report "will be met with a server error". The same notice says: "Any notices and orders served by the Court on or after Friday, October 9th have not been mailed to the appropriate parties."

The Judiciary's noticing page describes mandatory electronic noticing for entities that were mailed 25 or more paper notices in a month: after a set period their notices go only to a BNC-hosted account, and it says that "usage of the BNC website constitutes notice" in the cases where they are a party. The electronic noticing links on the S.D.N.Y. and S.D. Fla. home pages point to bankruptcynotices.uscourts.gov, one of the sites named as unavailable. Put together, which is this briefing's reading of how the pages fit and not a Judiciary description, the BNC is the producer of the notice, the mailer, the registry of preferred addresses, the electronic mailbox of the largest recipients and the source of the creditor list. One operator sits behind all five roles. The fallback uses only the one the courts keep in CM/ECF.

What the rules say when notice does not go out

The rules were read from the Cornell Legal Information Institute's copies of the Federal Rules of Bankruptcy Procedure, which show amendments through 1 December 2024. This briefing assumes nothing in them changed on 1 December 2025 (not checked). The Judiciary's pending-amendments page lists changes to Rule 9006 from 1 December 2026, to Rule 2002 from 1 December 2027 and to Rules 2003, 9006 and 9036 from 1 December 2028; none of those texts was read. The table gives the rule's words where they matter and says where each stops. It is a reading, not legal advice.

Rules read on 17 October 2026 from the Cornell Legal Information Institute (links in the sources list).

Rule	What the text says	Where it stops
2002(a), (b), (f), (m)	The clerk or the court's designee must give "at least 21 days' notice by mail" of nine events, including the creditors' meeting, and at least 28 days of disclosure statement and plan events. A court may direct some other person to give notice and designate its form and manner.	Says who gives notice and for how long. Does not say what happens when the channel is down. The "designee" wording is the hook for S.D. Fla.'s assignment of notices to debtors, whose mailing its order calls that of "a person designated by the Court".
9036(b)(2)(A), (d)	A registered electronic address in the Judiciary's noticing programme: "the clerk must use that address". Electronic notice is complete on sending but "is not effective if the filer or sender receives notice that it did not reach" the person.	The address registry and the channel are one programme, and it is the programme that is unavailable.
9006(b)(1)	The court may extend a time for cause if asked before it expires, or afterwards on excusable neglect.	The four relief orders rest on this rule.
9006(b)(2), (3)	The court "must not extend" the time under Rules 1007(d), 2003(a) and (d), 7052, 9023 and 9024. For Rules 3002(c), 4004(a), 4007(c), 4008(a) and 8002 it may extend only as those rules permit.	A court order that cites Rule 9006 cannot do what these rules bar.
3002(c)(7)	On a creditor's motion, before or after the time expires, the court may extend the time to file a proof of claim by no more than 60 days from its order, if "the notice was insufficient to give the creditor a reasonable time to file".	A motion is needed, and the creditor must know to file it. Proof of claim is 70 days in a voluntary Chapter 7, 12 or 13 case.
4004(a), (b)(1)	A Chapter 7 discharge objection is due 60 days after the first date set for the creditors' meeting, on at least 28 days' notice. An extension motion "must be filed before the time has expired".	A creditor who does not know the meeting date cannot know the expiry.
9022(a)(2), 8002	Under Rule 9022(a)(2), "lack of notice of the entry does not affect the time to appeal" except as Rule 8002 permits. Appeal within 14 days; the court may extend if a motion is filed in time or, on excusable neglect, within 21 days after.	Rule 8002(d)(2): no extension for orders granting stay relief, authorising a sale or credit, assuming or assigning a contract, approving a disclosure statement or confirming a plan.

A worked example, derived from the rules and labelled as arithmetic. A voluntary Chapter 7 petition filed on Friday 9 October is also the order for relief (11 U.S.C. section 301(b)). Rule 2003(a)(1)(A) puts the creditors' meeting 21 to 40 days after the order for relief: Friday 30 October to Wednesday 18 November (derived). At least 21 days' notice by mail is needed for a meeting on the last permitted day, so the latest date by which that notice could still be mailed is Wednesday 28 October (derived), 11 days after the Saturday reading. Rule 9006(b)(2) says the court must not extend the time under Rule 2003(a), so the lever is to get the notice out, which is why S.D. Fla., C.D. Cal. and W.D. Mich. are moving the work to debtors' lawyers, lodging parties and clerks (inference). If the outage were still running when it reached each window's length counted from 9 October, that would be Friday 23 October for 14 days, Friday 30 October for 21, Friday 6 November for 28 and Friday 18 December for 70 (derived).

One order shows the clock biting already. E.D. Tex. General Order 26-2 covers cases filed on or after 14 September in which a motion to continue the stay is filed. Fourteen September plus 30 days is 14 October (derived), the day the order was signed. Whether that is why the order was written is not stated, and the order itself only says the BNC interruption "has impaired the ability to provide timely notice to creditors" of those motions.

Who runs the BNC, and what is not public

The Judiciary says BAE Systems "operates BNC systems and websites on behalf of the Federal Judiciary". A BAE spokesperson told The Register that "BAE Systems, Inc. operates the Bankruptcy Noticing Center (BNC) on behalf of the Administrative Office of the U.S. Courts", and the ABA Journal describes the operator as a U.S. subsidiary of BAE Systems. The Record calls BAE a British multinational. So the operator named on the record is BAE Systems, Inc., inside a UK-headquartered group.

Two other facts from the Judiciary's own pages. Its list of approved bankruptcy notice providers, approved to give notice under Rule 2002(g)(4), has 23 entries (derived), and one of them is "BAE Systems Information Technology" with a Virginia address. That shows BAE as a listed provider; it does not show that this is the entity operating the BNC. And a Judiciary page dated 23 July 2012 says all bankruptcy courts use the BNC and that it transmitted "more than 160 million notices" the year before, and refers to "the BNC contractor" without naming it. That figure is 14 years old. The Judiciary's statistics release says total filings fell from nearly 1.6 million in September 2010 to a low of 380,634 in June 2022 and were 608,511 in the 12 months to 30 June 2026, so the 2012 figure is context and not a current volume.

The contract is not public in anything read: no value, term, security clause, incident-reporting clock, subcontractor, data location or backup arrangement. A query of the USAspending award database for "bankruptcy noticing" returned nothing, which says little because the Judiciary may not report there. If the contract has a clause telling BAE how fast and to whom it must report an incident, that clause is not on the record, and neither is any statement of whether it was used.

BAE's own channels say nothing. At about 11:15 BST on 17 October, read in a browser, the global newsroom listed four news releases, the newest on 15 October about a satellite communications contract, and the US newsroom for BAE Systems, Inc. showed the same newest item. BAE's regulatory news feed, which carries London Stock Exchange announcements, listed its latest entry as 12 October at 10:56, a share transaction notice, five days before the reading (derived). Whether an event is inside information is the company's own judgement, so the absence of an announcement is not evidence either way.

What BAE says, and where it says it

BAE's statement reached the public through reporters. Six outlets read quote it as "aware of a security incident that is isolated to the BNC system" and say BAE has "taken immediate steps to address it" and is coordinating closely with AOUSC (derived count). One of the six (CyberScoop) adds "No other systems have been affected". One (The Register) adds the sentence naming BAE Systems, Inc. as the operator. SecurityWeek reports that neither the Judiciary nor BAE said what caused the incident, whether it was a cyberattack or whether any data was compromised, and that BAE's statement did not address those questions. The Record reports that AOUSC did not respond to requests for detail on the nature of the incident or on whether data was stolen. Infosecurity reports that the Judiciary did not say when it began.

Two headline claims go further than the primary. The Register wrote that the courts "are currently down", and several outlets used the word cyberattack. The courts say they are open and filing, and the Judiciary's own word is cybersecurity incident. Press accounts also mention earlier incidents at the Judiciary and at Arizona's court system. No source read links any of them to this one.

The friendly-name fallacy: six words that do the work of a control

Words used about the BNC outage, who uses them, and what each leaves unsaid.

Word and who uses it	What it can tell you	What it hides
"isolated to the BNC system" (BAE)	BAE's claim that it has not seen the incident spread beyond the BNC system.	Isolated from what, shown how and checked by whom. The BNC is the national notice system, so "isolated" describes spread to other BAE systems and says nothing about size, data or duration.
"security incident" (BAE), "cybersecurity incident" (Judiciary), "cyberattack" (headlines)	Something happened to security. The first two terms are the parties' own.	Whether it was malicious. The headline word attack is the press's. The record contains no cause, no actor and no claim of responsibility.
"contractor" (Judiciary, courts)	A third party runs the service for the Judiciary.	That the contractor holds the address registry, the notice queue and the recipients' mailboxes. Its contract, security terms and reporting clock are not public.
"noticing" and "service interruption" (courts)	Mail and electronic notices are delayed.	Notice is a legal act with timed consequences under Rules 2002 and 9036, so "delayed" hides a gap in which no notice exists.
"working to restore operations" (Judiciary)	Someone is working on it.	What is restored and in what order: the backlog, the registrations, the duplicates. No date and no description of the backlog.
"no party shall be prejudiced" (four courts)	The court will not hold a missed response against a party.	It is "subject to applicable law", and Rules 9006(b), 3002(c), 4004(a) and 8002 limit what a court can undo. S.D. Fla. says its order alters no deadline.

Stated and not stated

What the record fixes and what it leaves open, as of 11:45 BST on Saturday 17 October 2026.

Question	Stated, and by whom	Not stated
What is down	The Judiciary: BNC systems and websites BAE operates, the noticing process, three named websites and the NCRS; production and distribution of notices halted.	A complete list. Whether generated notices are queued, lost or recoverable. Whether any part is back.
Since when	Courts, citing the Administrative Office: beginning on 9 October; two say late on Friday 9 October.	A start time. When BAE first detected the problem. Anything on dates in the release itself.
Cause	The Judiciary: cybersecurity incident. BAE: security incident.	Whether it was an attack, ransomware or malicious at all. How access was gained.
Data	Nothing.	Whether any data was accessed or taken. The BNC functions courts describe include address registrations and debtor notice accounts; whether any was touched is not stated.
Spread within BAE	BAE: isolated to the BNC system; to one outlet, no other systems affected.	Any evidence. Whether the Judiciary or an outside party has checked. Whether BAE runs other systems for the Judiciary.
Restoration	The Judiciary: working to restore operations. S.D.N.Y. on 13 October: no estimated date. S.D. Fla. on 16 October: unknown.	Any date, from the Judiciary or BAE.
Deadlines	Courts: four no-prejudice orders, two orders that move service to others, one letter. S.D. Fla.: no deadline altered.	Any national order. Any count of deadlines or cases affected. The release says nothing.
Scale	The Judiciary: all federal bankruptcy courts. Its About page: 90 bankruptcy courts. This briefing's scan: 83 of 85 court home pages that answered carry BNC outage text (derived, a loose keyword test).	A count of cases, notices or parties affected. For scale only: 608,511 filings in the 12 months to 30 June 2026 is 1,667 a day, so about 13,300 to 15,000 new filings in the 8 to 9 days since 9 October at that average (derived; not a count of affected cases).
Responsibility and agencies	Nothing found: no claim of responsibility, no CISA statement (news page newest 8 October); the FBI page returned a block and was not read.	Whether any agency is involved.
Contract	The Judiciary and BAE: BAE operates the BNC; BAE Systems, Inc. per its spokesperson.	Value, term, security terms, reporting clock, subcontractors, data location.
UK	BAE is UK-headquartered (press). The named operator is BAE Systems, Inc.	Any UK court or government service on the same system. Nothing read says so.

UK: what a buyer of outsourced public-service systems can rely on, and where each piece stops

BAE Systems is a UK-headquartered group (as The Record and the ABA Journal describe it, and its regulatory news runs through the London Stock Exchange), but nothing on the record says a UK court, department or public body uses the BNC or the same BAE system, and BAE's own statement is that the incident is isolated to the BNC system. No primary read supports a dependency for HMCTS or any other UK court system, so none is claimed. The lesson for a UK buyer is about the shape of the arrangement: a public function, run by a supplier, whose failure leaves the customer unable to perform a legal duty and dependent on the supplier for the facts. The table sets out what UK guidance, policy and law say about that shape, as read on 17 October, and where each piece stops.

UK texts read on 17 October 2026. A reading of the pages, not legal advice.

Text	What it says, as read	Where it stops
NCSC supply chain security guidance (published 28 January 2018, reviewed 22 October 2025)	Twelve principles. Principle 9: "clearly set out requirements for managing and reporting security incidents in the contract", including "reporting timescales, who to report to". The control section says to "identify critical assets and any over-reliance on single suppliers". Principle 6 asks for contracts to cover "termination and the transfer of services to another supplier".	Guidance, not a duty. It says it was not written for organisations with national security (high assurance) requirements. It binds a supplier only if a contract adopts it.
Government Cyber Action Plan (DSIT, first published 6 January 2026, last updated 20 March 2026)	Government organisations are "responsible for applying appropriate mechanisms (including good procurement practices, contractual security and resilience terms and audit and review processes)" for suppliers. Suppliers will "proactively report and cooperate on cyber incident response and recovery impacting government organisations". It cites the 2024 CrowdStrike outage as showing how "a single supplier dependency can create widespread disruption".	Expectations for UK government and its suppliers. A statement of what suppliers will do is not a contract term. Whether it reaches a given court or agency depends on its status, which was not checked.
Cyber Security and Resilience (Network and Information Systems) Bill (Lords report stage listed for 26 October 2026)	Defines a managed service as ongoing management of a customer's IT systems by connecting to or obtaining access to them. As printed, a relevant managed service provider must give an initial incident notification within 24 hours of first awareness and a full one within 72, to the Information Commission, for an incident whose UK impact is or is likely to be significant. See [the earlier briefing on the Bill](https://www.pk-sharma.com/briefing/uk-cyber-bill-ai-appears-0-times-in-text-0-of-47-report-amendments-on-13-october-list-are-governments).	Not law. The relevant provisions start on a day the Secretary of State appoints by regulations. It covers managed services provided in the UK by providers that are not micro or small, and says nothing about a US court's noticing system. Whether a hosted application with an operator is a managed service depends on the contract.
NCSC incident reporting (report.ncsc.gov.uk)	A report should be made if an incident affects data on employees, customers or clients, computer hardware or software, or personal data of the UK, Channel Islands or Isle of Man. Reports are watched 24/7. "Reporting using this service does not fulfil any legal or regulatory reporting requirements."	It will not share with regulators such as the ICO without consent. It is a route to help, not a notification under any statute.
UK GDPR Article 33 and the ICO's breach page	A controller must notify the regulator "where feasible, not later than 72 hours after having become aware" of a personal data breach unless it is unlikely to risk people's rights; a processor must notify the controller "without undue delay". The article now says "the Commission", substituted from 30 September 2026. The ICO's page says its guidance is under review after the Data (Use and Access) Act.	Applies only to personal data within UK GDPR. Whether any personal data was involved in the BNC incident is not stated, and whether UK GDPR would apply to it is not established.

Where each piece stops, in one line: the NCSC guidance is advice, the Action Plan sets expectations for government and not contract terms, the Bill is not law and would reach only managed services provided in the UK, the NCSC reporting route is not a statutory notification, and UK GDPR applies only if personal data within its scope is involved. None of them tells a buyer how to hold a copy of the supplier's data that the fallback needs. That is a contract and an architecture decision, and the BNC outage shows what its absence looks like: a creditor list that lacks the registered addresses.

Checklists, in the order worth doing

The question that exposes the gap

BAE says the incident is isolated to the BNC system, and the Judiciary says the same system produces the legal notices for every federal bankruptcy court. So the question for any buyer of a public function is the one this outage leaves open: when the system that sends the notices is the system that fails, who says so first, who sends the notices in the meantime, and which clause, if any, said so before it happened?

Key facts