Skip to content

Back to the catalog

BAE Systems Security Incident Stalls Notices From US Bankruptcy Courts
securityweek.comarticle

BAE Systems Security Incident Stalls Notices From US Bankruptcy Courts

A cybersecurity incident at BAE Systems, which runs the Bankruptcy Noticing Center (BNC) for the US judiciary, has stopped all federal bankruptcy courts from generating or sending notices for about a week. The incident was reported to the Administrative Office of the US Courts late on October 9. The National Creditor Registration Service is offline, and notices issued since then have not been delivered. Neither BAE nor the judiciary has said what caused the incident, whether it was a cyberattack, or whether data was compromised. The case shows how a single contractor outage can disrupt a nationwide government function.

TL;DR A BAE Systems security incident has taken the US bankruptcy courts' noticing center offline since October 9. The cause and any data exposure are undisclosed.
Open original ↗
Document

What it is

A security incident at BAE Systems, the contractor that runs the Bankruptcy Noticing Center (BNC) for the US judiciary, has taken the BNC offline. The Administrative Office of the US Courts says the BNC is no longer generating or sending notices for any federal bankruptcy court. BAE first told the Administrative Office of the problem late on October 9, per the US Bankruptcy Court for the Eastern District of Texas.

Scope of the outage

The Administrative Office states that "all access to the BNC systems and websites that BAE operates on behalf of the judiciary and the related bankruptcy noticing process are unavailable." The disruption hit both BAE's notice-processing systems and the BNC websites. BAE describes the incident as "isolated to the BNC system."

Still working:

  • Electronic filing notifications to registered attorneys, trustees and the US Trustee.
  • Court acceptance of filings and the opening of new cases.

Not working:

  • Paper and electronic notices issued through the BNC since October 9 have not been delivered.
  • The National Creditor Registration Service is offline. Users of the courts' e-filing system cannot generate the creditor mailing lists they normally use to serve documents.

What to do

The page gives no remediation steps. Its implications for anyone involved in bankruptcy proceedings:

  • Do not assume a creditor or party received a court notice issued since October 9. Courts have said those notices were not delivered.
  • Service that depends on a generated creditor mailing list is blocked while the registration service is down.
  • Watch the individual court's website for guidance. Several courts posted notices on October 13 calling this a "service disruption" or "interruption," and none mentioned a cybersecurity incident. Search for the "cybersecurity incident" wording at the Administrative Office level, not only on local court pages.

Caveats

  • Neither BAE nor the judiciary has said what caused the incident, whether it was a cyberattack, or whether any data was compromised. SecurityWeek has asked BAE and said it will update the article.
  • No restoration date has been given.
  • The page does not say whether the deadlines affected by undelivered notices will be extended.

Organisations named here

  • BAE Systems
  • Administrative Office of the US Courts
  • Bankruptcy Noticing Center
  • National Creditor Registration Service

Related in Threat Intel