BAE Systems Got Hacked and Took U.S. Bankruptcy Courts Offline

What went down

The Bankruptcy Noticing Center — a system operated by a U.S. subsidiary of British defense giant BAE Systems — was hit by a cybersecurity incident that took down the websites and services BAE runs for the U.S. judiciary. The casualty list reads like critical government plumbing: BNC.uscourts.gov, BankruptcyNotices.uscourts.gov, Notices.uscourts.gov, and the National Creditor Registration Service. The Administrative Office of the U.S. Courts said it is coordinating with BAE Systems while the company investigates and works to restore operations.

Reporting broke on October 16 via the ABA Journal, which means this BAE Systems breach is still unfolding. The company has not yet disclosed the attack vector, the scope of data exposure, or a restoration timeline. In the October breach wave that already defined this month, this one stands out for a reason that has nothing to do with victim count.

Why this breach is different

Most breaches are a company losing its own customers' data. This one is a defense contractor losing the infrastructure it runs for someone else's government. BAE Systems is a British defense company. It operates the notification systems of the United States federal bankruptcy courts. Let that arrangement sit for a moment.

There is nothing inherently scandalous about outsourcing — governments outsource IT constantly, often for good reasons. But every outsourcing arrangement is a bet: that the vendor's security posture is at least as strong as the government's would be, and that there is a plan for the day the bet loses. This week, the second part of that bet failed visibly. When the vendor goes down, the courts go down with it, and the Administrative Office of the U.S. Courts can only coordinate and wait.

The unsettling part is the asymmetry. Bankruptcy proceedings do not pause for incident response. Creditors have notice deadlines. Debtors have filing deadlines. Every day the notice systems are dark, real legal timelines are slipping for people who had nothing to do with BAE's network security.

The single-point-of-failure lesson

Strip away the defense-contractor angle and the lesson is embarrassingly ordinary: a single vendor, a single incident, a national system offline. This is the same failure mode as Atlassian's exploited self-hosted flaw — critical infrastructure with a single throat to choke — except the throat here is a third party.

For organizations, the question to ask Monday morning: which of your critical services has exactly one vendor between you and your users? Not one vendor plus a backup plan — one vendor, full stop. If the answer is 'we don't know,' that is the same as 'yes.'

What the courts should do Monday morning

The fix is not 'stop outsourcing' — no court system is building its own notice infrastructure from scratch. The fix is treating vendor resilience like a legal requirement, not an IT preference. That means contract clauses with teeth: maximum recovery times, mandatory isolated backups the vendor cannot take down with itself, and tested failover drills that happen before an incident, not after. It also means asking the uncomfortable procurement question — should one foreign defense contractor really be the sole operator of notice systems for the entire federal bankruptcy apparatus? Diversification is not paranoia; it is the difference between an incident and an outage.

What to do if you are affected

If you have business before the bankruptcy courts — filings, creditor claims, scheduled notices — do not assume the deadlines moved. Courts generally do not grant automatic extensions because the IT vendor was breached; check with your attorney and the court clerk directly, and keep written records of anything you attempted to file. The systems will come back. The deadlines may not wait.