The Administrative Office of the U.S. Courts said on 15 October that a cyber incident at BAE Systems has taken down the Bankruptcy Noticing Center, the system that produces and transmits notices for every federal bankruptcy court in the country.

All access to the BNC systems and websites BAE operates for the judiciary is unavailable, including bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov and the National Creditor Registration Service. Production of notices has stopped. BAE says the incident is "isolated to the BNC system" and that it is working to restore operations.

Most coverage filed this as an outage at a contractor. The judiciary's own rules make it something more specific than that.

For some recipients, the website is the service

The courts' noticing page describes a process called Mandatory Electronic Bankruptcy Noticing. Under Federal Rule of Bankruptcy Procedure 9036(b)(2)(B), any entity mailed 25 or more paper bankruptcy notices by the BNC in a single calendar month is designated a high-volume paper-notice recipient.

Those recipients get a notice explaining how to register for an electronic account, a reminder about 45 days later, and then, roughly 105 days after the month they crossed the threshold, electronic service starts whether or not they registered. There is a 30-day overlap, called redundant mode, where notices go out both electronically and by post so the recipient can confirm it works.

After that overlap ends, for anyone who did not register, the rule is this: all future notices are sent only to a mandatory electronic account hosted by the BNC, the recipient is responsible for checking it, and, in the judiciary's own words, "The usage of the BNC website constitutes notice in the case(s) in which they are a party."

That sentence is why this is not only an IT problem. For that population, the website is not a convenience layered over service of notice. It is the mechanism by which service happens.

What is actually known, which is not much

The judiciary's statement says the Administrative Office "has been in communication with the impacted courts" and that "BAE is actively investigating this incident and working to restore operations".

Everything a reader would want next is missing. There is no restoration date. There is no count of delayed notices, affected courts, creditors or cases. The office has not said what kind of incident it was or whether data was taken, and did not answer questions on either point. Nobody has named an attacker. One report dates the outage to 9 October from court notices, six days before the judiciary named it, and we have not seen that date confirmed elsewhere.

BAE's statement that the incident is isolated to the BNC system is, at this stage, the company's own characterisation of its own incident. It may well be right. It is not independently established.

The shape of the risk is the familiar one

Bankruptcy noticing is a reasonable thing to centralise. One system that formats, prints, posts and transmits notices for every bankruptcy court is cheaper and more consistent than ninety-four districts each building their own, and the Mandatory Electronic Bankruptcy Noticing programme exists precisely because centralising the high-volume recipients saves postage.

The cost of that efficiency is that the whole function has one failure mode. There is no district that is unaffected because it chose a different vendor, because there is no choosing.

This is the third story in a fortnight here where a single supplier sat underneath a function nobody thought of as a supplier relationship. We wrote this week about the three Next.js advisories and the conditions that decide who is actually exposed, and about AI agents reaching live company systems through credentials nobody had rotated. The pattern underneath all three is the same question: what else is downstream of this thing, and who would find out first.

What to do

  • If you are a creditor, trustee or counsel in a federal bankruptcy matter, check whether your notices come through a BNC-hosted electronic account. If they do, the absence of notices right now is not evidence that nothing was issued.
  • Do not assume a missed deadline is uncontested. Document when you first could not access the account and keep the judiciary's statement with that record. This is a question for counsel, not for a news article, and it is a question worth raising early.
  • Court by court, watch for local orders. Where a nationwide noticing system stops, extensions and tolling tend to be handled district by district rather than centrally.
  • For anyone running a service other people are legally obliged to read: the lesson is that availability became a compliance property the moment the rules said using the site constitutes notice.

What is not established

  • When the outage began. The judiciary named it on 15 October; a 9 October start appears in one report, sourced to court notices rather than to the Administrative Office.
  • What kind of incident this was, and whether any data was taken. Neither the judiciary nor BAE has said.
  • Whether it is genuinely confined to the BNC. That is BAE's statement about its own systems.
  • How many notices, courts, creditors or cases are affected, and when service will resume.
  • Who is responsible. No attribution has been offered by anyone.
  • What the legal effect is on deadlines that depend on service of notice. Nothing published so far addresses it, and it is the question the rule above makes unavoidable.