BAE Systems Bankruptcy Noticing Center Cyber Incident Halts Notices for Every U.S. Bankruptcy Court

Updated October 16, 2026, 5:15 PM Central. The Bankruptcy Noticing Center remains offline, and its addresses still fail at the DNS layer. The Administrative Office of the U.S. Courts has not updated its October 15 statement and has not said whether any data was accessed. BAE now says "No other systems have been affected" (Cybernews).

The Bankruptcy Noticing Center (BNC), operated under contract by BAE Systems, produces and sends notices for every federal bankruptcy court. It stopped on or about October 8 or 9, 2026. According to the U.S. Bankruptcy Court for the Eastern District of Texas, BAE notified the Administrative Office late on Friday, October 9. Courts began posting notices of a "service disruption" on October 13. On October 15 the AO identified it as a cybersecurity incident, and a BAE spokesperson told The Record the company was "aware of a security incident that is isolated to the BNC system."

This page is the verified timeline. Cloudskope's analysis of what the outage means for creditors, deadlines and Social Security numbers is at BAE Was Hacked and Every Bankruptcy Court Went Silent. The Banks Are the Ones Without Notice.

The BNC is the judiciary's centralized noticing system. It retrieves notices and recipient lists from each bankruptcy court's servers, sends them by email, electronic data interchange, website posting or printed mail, and returns a Certificate of Notice to the court for docketing. It also runs two creditor registries: Electronic Bankruptcy Noticing (EBN) and the National Creditor Registration Service (NCRS), which holds creditors' preferred notice addresses under 11 U.S.C. 342(f).

Systems the AO lists as unavailable

• bnc.uscourts.gov
• bankruptcynotices.uscourts.gov
• notices.uscourts.gov
• The National Creditor Registration Service, which supports creditor address labels in CM/ECF

What still works

• Courts continue to accept filings, open cases and hold hearings.
• CM/ECF Notices of Electronic Filing to attorneys of record continue normally.
• PACER and court CM/ECF systems responded normally to Cloudskope's checks on October 16.

Who is affected

• Creditors, especially high-volume creditors (banks, credit unions, card issuers, auto lenders, servicers, collection agencies) enrolled in Mandatory EBN, whose notices are posted by default to a BNC website.
• Debtors, whose creditors may not learn of the automatic stay.
• Debtors' attorneys and chapter 13 trustees, who in some districts must now serve notices themselves.
• Small business chapter 11 and subchapter V cases, which often rely on court-generated notices rather than private claims agents.

Why the data matters

Under Bankruptcy Rule 2002(a)(1), the notice of the meeting of creditors includes the debtor's Social Security number unless the court orders otherwise. Official Form 309A states that full numbers "may appear on a version of this notice" while the version filed with the court shows only the last four digits. The creditor version is the one the BNC sends. No one has said whether that data was accessed.

Confirmed by Cloudskope observation (October 16, 2026, 1:55 to 2:15 AM Central)

• bnc.uscourts.gov, bankruptcynotices.uscourts.gov and notices.uscourts.gov did not connect. www.uscourts.gov, PACER and the Delaware bankruptcy CM/ECF system returned HTTP 200.
• All four BNC hostnames (including ebn.uscourts.gov) are CNAME aliases with 60-second TTLs into ebnuscourts.com, a domain registered August 10, 1998.
• Lookups for ebnuscourts.com returned SERVFAIL from Google, Cloudflare and Quad9 public resolvers (Extended DNS Error 22, no reachable authority).
• Its four nameservers (bailey, cooper, hunter and rocky.noticingcenter.com; noticingcenter.com registered December 16, 1999) did not respond. They sit on AT&T (AS7018) address space; ARIN lists 12.160.250.128/27 as assigned in May 2021 to "BAE Systems Inc BNC Suite 104," Logan, Utah. Neither domain uses DNSSEC.
• BAE corporate domains (baesystems.us, baesystems.com) and the judiciary's uscourts.gov zone resolved normally.
• No certificates issued for the BNC hostnames since November 24, 2025 (crt.sh).
• No leak-site claim against BAE Systems, the BNC or the courts (ransomware.live, most recent 100 postings and name search).

Assessment

The pattern is consistent with the BNC network being disconnected from the internet as a containment step, and with BAE's statement that the incident is isolated to the BNC. It does not indicate whether data was accessed. Initial access, mechanism and dwell time are unknown.

Relevant MITRE ATT&CK techniques (framing, not observed)

• T1199 Trusted Relationship: the BNC polls court servers and returns certificates for docketing.
• T1566 Phishing: expected follow-on lures impersonating re-sent bankruptcy notices.

Sponsors with consumer lenders, servicers, collection agencies, debt buyers or bankruptcy data platforms in portfolio should ask how each company ingests bankruptcy notices, what broke this week, and what stay-violation exposure the outage created. Distressed investors should verify claims and bar dates in small chapter 11 and subchapter V cases against the docket rather than against notices received.