BAE Was Hacked and Every Bankruptcy Court Went Silent. The Banks Are the Ones Without Notice.

UPDATE, OCTOBER 16, 2026 (EVENING)

At 5:11 PM Central, the Bankruptcy Noticing Center was still dark. bnc.uscourts.gov and ebnuscourts.com still returned SERVFAIL from Google's public resolver, the same failure we recorded at 1:57 AM. The Administrative Office's October 15 statement carried no update: no restoration date, no start date, and nothing about data.

BAE has added one sentence. A spokesperson told Cybernews: "We are aware of a security incident that is isolated to the BNC system and have taken immediate steps to address it," and "No other systems have been affected." That is a second statement about blast radius. It is still not a statement about what the BNC held.

The courts are starting to move hearings. Cybernews reports that the Alaska bankruptcy court is postponing certain creditor meetings for cases filed after October 9 until BNC operations resume, and counts bankruptcy courts in at least 14 states that have posted disruption notices. ACA International, the collections industry association, reports that the District of Colorado has warned 341 meeting notices may be delayed.

ACA International also told its members to run accounts worked since October 9 against bankruptcy scrubs and to check dockets directly where the stakes warrant it, the same reconciliation we recommend to boards below. SecurityWeek, Infosecurity Magazine and Cybernews covered the outage today. None reports data theft, a mechanism or a claim of responsibility.

1:57 AM Central

At 1:57 AM Central on Friday, October 16, 2026, Cloudskope asked the public internet a simple question: where does bnc.uscourts.gov live? It is the address of the Bankruptcy Noticing Center, the system that prints, emails and mails the court notices for every federal bankruptcy court in the United States. Google's public resolver answered that the name is an alias for bncgov.ebnuscourts.com, a commercial domain registered in August 1998, and that none of the four servers responsible for that domain would respond. Cloudflare's resolver gave the same answer in different words: "No Reachable Authority." At 2:13 AM, Quad9 said the same thing.

The day before, on Thursday, the clerk of the Bankruptcy Court for the Southern District of Georgia had posted instructions for anyone who needed the most basic document in a consumer bankruptcy, the notice that tells creditors a case exists and when the meeting of creditors will be held. Parties could email a copy request. Or they could ask in person at the clerk's offices in Augusta, Brunswick or Savannah. Or they could mail in a self-addressed, stamped envelope.

That is where the federal bankruptcy system is this week. A notice pipeline that sends electronic notices the same day a court produces them has been dark since October 8 or 9, depending on which court's order you read. The banks, card issuers, auto lenders and credit unions that were required to give up paper, and whose notices by default are posted to a BAE Systems website, have been receiving nothing. And the judiciary took six days from the contractor's first report to use the word "cybersecurity": four days of public silence, then two of "service disruption."

That is the incident as it has been reported. What follows is longer, because the incident is not the story. The story is what the Bankruptcy Noticing Center carries (the creditor copy of the notice is the one designed to show a debtor's full Social Security number), who is legally on the hook when notices stop (the creditors, not the contractor), which deadlines in bankruptcy generally cannot be extended after they pass no matter what a general order says, and a federal judiciary that its own technology chair told Congress in June 2025 runs systems that are "outdated, unsustainable due to cyber risks." By our count this is the third publicly acknowledged cyber incident to reach the federal courts' case infrastructure in six years. This time the system that failed belongs to a contractor.

What we verified

Every check below was passive: ordinary DNS lookups through public resolvers, registration records, certificate transparency logs, and normal page requests. We did not scan anything, log in to anything, or contact anyone claiming responsibility. No one has claimed responsibility.

The portals are down, and so is everything that tells the internet where they are. At 1:57 AM Central we requested bnc.uscourts.gov, bankruptcynotices.uscourts.gov and notices.uscourts.gov. None connected. In the same minute, www.uscourts.gov returned HTTP 200 with a page last modified at 04:30 UTC that morning, PACER returned 200, and the Delaware bankruptcy court's CM/ECF filing system returned 200. The courts' own filing systems are up. The noticing system is not.

The judiciary's addresses point into a contractor's domain. All four BNC hostnames in the judiciary's .gov zone are CNAME records, DNS aliases, that hand the question off to ebnuscourts.com: bnc.uscourts.gov to bncgov.ebnuscourts.com, bankruptcynotices.uscourts.gov to register.ebnuscourts.com, notices.uscourts.gov to noticesgov.ebnuscourts.com, and ebn.uscourts.gov to www.ebnuscourts.com. The judiciary's own zone, served from Akamai, resolves normally. The handoff is where it stops.

The contractor's domain has gone silent at the root. Between 1:58 and 2:14 AM Central, every lookup for ebnuscourts.com, for every record type we tried (A, NS, TXT, SOA and MX), returned SERVFAIL from Google, Cloudflare and Quad9. Google's resolver listed the four nameserver addresses it had tried: 12.160.250.131, 12.160.250.132, 207.243.117.47 and 207.243.117.48. Those servers are named bailey, cooper, hunter and rocky, all under a second domain, noticingcenter.com, registered in December 1999. Both domains are registered through Network Solutions. Neither is signed with DNSSEC.

The nameservers sit on AT&T address space registered to the BNC in Logan, Utah. The American Registry for Internet Numbers lists 12.160.250.128 through 12.160.250.159 as assigned in May 2021 to "BAE SYSTEMS INC BNC SUITE 104," 630 West 1000 North, Logan, Utah. The 207.243.117.x servers sit in a larger AT&T block with no public reassignment record. Both blocks are announced by AT&T's AS7018. There is no cloud or anycast secondary. In 2002, a clerk writing in the ABI Journal described the BNC as running two data centers, one in Reston, Virginia and one in Logan, Utah. Twenty-four years later, the address registry still points to Logan.

BAE's corporate infrastructure is fine. At 2:06 AM Central, baesystems.us, the domain on the BNC's own support email address, resolved normally, with mail exchangers under na.baesystems.com. baesystems.com resolved normally through a commercial DNS provider.

What those observations establish is a shape, not a cause. The BNC's public footprint has gone dark at the most basic layer, the authoritative DNS that tells the world where the BNC's servers are, while the judiciary's systems and BAE's corporate systems keep working. That pattern is consistent with the BNC environment having been disconnected from the internet as a containment step. It is also consistent with BAE's statement to The Record that the incident is "isolated to the BNC system." We are treating both as hypotheses. Neither tells anyone whether data left the building before the plug was pulled.

Certificates and claims. Certificate transparency logs show the BNC hostnames' current DigiCert certificates were issued on November 24, 2025, valid to December 25, 2026, with nothing issued since. There is no sign yet of the BNC being rebuilt somewhere new. Our searches of certificate logs for certificates issued since September 1 to lookalike names (variants of "bankruptcy notice," "noticing center" and "bnc notice") returned nothing, which on crt.sh means "nothing found," not "nothing exists." As of 1:55 AM Central, ransomware.live's feed of the most recent 100 leak-site postings and its search for "bae" showed no claim against BAE Systems, the BNC or the courts.

What we could not verify. We could not read archived copies of the BNC portals; the archive was not reachable from our environment. We could not determine when the intrusion began, how access was obtained, whether anything was taken, or whether the BNC's automated connections into court systems were touched. Only BAE and the Administrative Office of the U.S. Courts can answer those questions.

Six days of documents, in order

The judiciary does not have a single incident page for this. It has an Administrative Office statement and dozens of separate notices posted by individual bankruptcy courts, each in its own words. Read in order, they tell a story that none of them tells alone.

Friday, October 9, late. According to the Eastern District of Texas, that is when "BAE Systems, the contractor that services the BNC, notified the Administrative Office" of a problem affecting the systems that process notices and several related websites. The Texas notice is the only document we found that says when the AO was told. It also names the mechanism that stopped: "the court polling and certification drop-off process." Hold that phrase; it matters later.

Tuesday, October 13. The courts start posting. The Eastern District of New York: "The Bankruptcy Noticing Center (BNC) is experiencing a service disruption nationwide," and "BAE Systems, the contractor that services the BNC, is actively investigating the disruption." The Southern District of Indiana says the interruption began Friday, October 9, that "notices generated by the Court currently cannot be served through the BNC," and that "the interruption remains unresolved." The Southern District of New York, home to much of the country's large chapter 11 docket, and the Middle District of Alabama post nearly identical text: an outage "since October 9, 2026, affecting all U.S. Bankruptcy Courts," and "At this time, we do not have an estimated date or time for restoration of services." Indiana's chief judge signs General Order 26-0003 the same day.

Not one of the October 13 notices we read uses the word cyber. They say disruption, interruption, outage. Those words were accurate. They were also incomplete. By then the AO had known for four days that its contractor was "investigating."

Wednesday, October 14. The Northern District of Florida enters Administrative Order 26-003, signed by Chief Judge Mary W. Colón, which dates the interruption differently: "beginning on or about October 8, 2026." The Middle District of Tennessee shifts the work to the bar: in new chapter 7, 11 and 12 cases filed on or after October 8, debtors' attorneys must serve the notice of commencement themselves; in chapter 13, the trustee will. The next day, the Southern District of Georgia's copy-request instructions would cover cases filed after October 7. Three courts date it from October 8; the earlier notices said October 9. The AO has published neither.

Thursday, October 15. The Administrative Office posts "Cybersecurity Incident Disrupting Bankruptcy Court Operations." It names BAE Systems as the operator. It lists the four affected systems: bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov and the National Creditor Registration Service. It says the BNC's production and distribution of notices has halted, and that "BAE is actively investigating this incident and working to restore operations." A BAE spokesperson told Jonathan Greig of The Record that the company was "aware of a security incident that is isolated to the BNC system." CISA referred questions to the courts. The FBI did not respond.

Now read the AO statement for what it does not contain. No start date. It does not reconcile October 8 with October 9. No mechanism: not ransomware, not intrusion, not credential, not vendor software. No statement about data, not even the familiar "no evidence" formula. No restoration estimate. No word on whether notices queued since October 8 will be released, regenerated or abandoned. No guidance on deadlines; that is left to roughly ninety separate bankruptcy courts, each writing its own order. And nothing addressed to the creditors whose notices were moved off paper and onto a BAE-run website.

BAE's sentence is even shorter. "Isolated to the BNC system" is a statement about blast radius inside BAE. It says the problem did not spread to the rest of a defense contractor's network, which is the question BAE's other customers would ask first. It does not say what the BNC system held, whether it was copied, or whether the BNC's connections into the courts were in scope. Those are the questions the courts' customers would ask first, and nobody has answered them.

What the Bankruptcy Noticing Center actually does

Most people who have never filed or worked a bankruptcy case have never heard of the BNC. Most people who work in consumer credit cannot do their jobs without it.

The Administrative Office developed the BNC in 1994 to centralize what every clerk's office had been doing by hand: printing notices and stuffing envelopes. By 2002, according to an ABI Journal column by a bankruptcy clerk, it ran data centers in Reston, Virginia and Logan, Utah, retrieved case data from the courts by electronic polling, and prepared and served "millions of bankruptcy notices and orders." The judiciary saved roughly 27.5 cents in postage on every notice it could send electronically instead.

Today the BNC is run under contract by BAE Systems. A 2025 continuing-education deck presented to the Bankruptcy Court for the District of Kansas by the BNC's project managers, carrying a BAE Systems copyright, describes the flow. The BNC retrieves the list of notices and recipients from each court's servers. It cleans addresses against Postal Service software and checks them against two registries it maintains. It sends the notice by email, by electronic data interchange, by posting to a website, or by printing and mailing it. Then it places a Certificate of Notice back on the court's server, and that certificate is docketed in the case as the court's proof that notice was given. Returned mail goes to a facility on Holiday Drive in Sterling, Virginia.

The two registries are the reason creditors should care. Electronic Bankruptcy Noticing, EBN, lets a creditor register to receive notices by email or as data feeds. The National Creditor Registration Service, NCRS, lets a creditor file a preferred mailing address under 11 U.S.C. 342(f), to be used by every bankruptcy court. When a lawyer pulls a creditor mailing matrix in CM/ECF, the system substitutes the preferred addresses from the BNC's database. NCRS is one of the four systems the AO listed as unavailable.

Then there is the program that turns a convenience into a dependency. Under Mandatory EBN, the BNC watches for recipients that receive high volumes of paper notices, which the BNC's own program page defines as "25 or more notices" sent to one address. Those recipients are invited to register, then warned, then, about 105 days later, enrolled. After a 30-day period of sending both paper and electronic copies, paper stops "without further notice." From then on, notices are posted to a website. The page is plain about whose job it is to look: "It is your responsibility to access this website regularly to retrieve any bankruptcy notices sent to you." And it is plain about the legal effect: "Your usage of this website constitutes notice in the case(s) that you are a party." (That page is on one of the hosts that is down; we read it through a cached copy.)

Who receives 25 or more bankruptcy notices at one address? Card issuers. Auto lenders. Mortgage servicers. Student loan servicers. Collection agencies. Hospital systems. Utilities. The IRS, which the 2002 column named as one of the judiciary's top electronic data interchange participants. And the credit unions and community banks whose members file for bankruptcy every week, wherever the volume at one address crosses the threshold. For the largest creditors in America, the BNC is not one channel among several. For a great many notices, by design, it is the only one.

The notice that is built to carry a full Social Security number

Every individual bankruptcy case begins with a notice to creditors on Official Form 309, the notice of the case and of the meeting of creditors under section 341. The version on the public docket shows only the last four digits of the debtor's Social Security number. The version mailed or emailed to creditors is different, by design.

The form itself says so, in a box near the bottom of Official Form 309A: "To help creditors correctly identify debtors, debtors submit full Social Security or Individual Taxpayer Identification Numbers, which may appear on a version of this notice. However, the full numbers must not appear on any document filed with the court." The rule behind it is Bankruptcy Rule 2002(a)(1), which requires the notice of the meeting of creditors to include the debtor's Social Security number "unless the court orders otherwise." The drafters explained the design in a 2003 committee note: the clerk is directed to include "the debtor's full social security number and employer identification number on the notices served on the United States trustee, the trustee, and creditors," while "The copy of Official Form 9 included in the case file, however, will show only the last four digits." The purpose was privacy on the internet and accuracy for creditors. The result is a two-version document, and the version with the full number is the one the noticing system sends out.

That is the version that flows through the BNC. It is the reason a bank's bankruptcy department can match a filing to the right account holder without a phone call. It is also the reason the BNC is not a print shop. It is a system whose ordinary daily output pairs names, home addresses, the full Social Security numbers of people in financial distress, and the list of every creditor they owe.

How much flows through it? Epiq AACER counted 52,007 bankruptcy filings in August 2026, 49,377 of them by individuals, with individual filings up 9 percent from a year earlier. August had 21 business days. That is roughly 2,350 individual cases a business day. Our estimate, and it is only an estimate, is that roughly 9,500 to 12,000 individual cases were filed in the four to five court business days between the BNC going dark and October 16 (Columbus Day, October 12, the courts were closed), each of which would ordinarily have generated a creditor notice through it. Then there is everything already in the system: the notices the BNC posts to its website for creditors to retrieve "regularly," which a retrieval site must store, for some retention period nobody has published.

We want to be precise about the limits of this section. Nobody has said data was taken. No group has claimed the BNC. BAE says the incident is isolated to the BNC system, and the evidence we gathered is consistent with fast containment. We do not know how the BNC stores notice content at rest, or whether the full numbers are retained after a notice is sent. What we know is what the system is built to carry. That is the reason the absence of any data statement from the AO, six days in, is not a small omission.

The creditors are the ones on the hook

When the BNC stops, the cost does not land on the BNC. It lands on creditors and debtors, and in consumer bankruptcy many of the largest creditors are financial institutions.

The automatic stay under section 362(a) takes effect the moment a petition is filed. It does not wait for notice. A lender that keeps debiting an account, calls a borrower, or repossesses a car after the filing is acting against the stay whether or not it knew. What the law does give a creditor that did not know is protection from money penalties. Section 342(g)(2) says a monetary penalty, including one under section 362(k), may not be imposed for a stay violation "unless the conduct that is the basis of such violation or of such failure occurs after such creditor receives notice effective under this section of the order for relief."

Read that next to the Mandatory EBN page. For the high-volume creditor enrolled in website delivery, notice effective under section 342 has, for years, meant a document posted to a BAE-run site, and the BNC's own terms say that using the site constitutes notice. For the creditor that registered a preferred address through NCRS under section 342(f), notice goes to that address, and Rule 2002(g)(4) provides that an address an entity supplies to a notice provider is "conclusively presumed to be a proper address." The plumbing that makes notice legally effective for the biggest creditors in the country runs through the system that is offline.

That cuts both ways, and the next weeks will show which way it cuts. In the near term, a creditor whose notices never arrived has a strong position against penalties. It still has to unwind whatever it did after the petition date: reverse the debits, return the payments, release the collateral, stop the calls. The operational cost of that unwinding is real and it is not covered by section 342. In the medium term, some courts have told debtors' attorneys and chapter 13 trustees to serve notices themselves, using creditor lists pulled from CM/ECF that the Southern District of Georgia warns "may not include" the addresses registered through EBN or NCRS. Those notices will go to whatever address the debtor listed, which may be a payment lockbox or a branch. Under section 342(g)(1), a notice that misses a creditor's designated bankruptcy unit is not effective "until such notice is received by such person or such subdivision." Expect disputes about exactly when that happened.

Then there is the question nobody has asked in public yet. When the BNC comes back, it will presumably process a backlog. What date will the Certificates of Notice carry when they are docketed? The date the notice was queued, the date it was transmitted, or something else? For a creditor arguing about when a stay violation began or whether a deadline ran, the docketed certificate is the evidence. The AO should say how it will handle this before the backlog moves, not after.

The deadlines that do not bend

Every court order we read uses the same protective language, and it is good language as far as it goes. Indiana's General Order 26-0003 and Northern Florida's Administrative Order 26-003 both find good cause under Rule 9006, both provide that no party "shall be prejudiced by a failure to respond to a notice" that was not served because of the BNC interruption, and both let the court extend or reset deadlines on request. Both orders also contain four words that every bank's bankruptcy counsel should underline: "subject to applicable law."

Applicable law includes Rule 9006(b)(3), which says the court may extend the time to act under a list of rules, including 3002(c), 4004(a) and 4007(c), "but only as permitted by those rules." A general order cannot rewrite them.

The sharpest is Rule 4007(c). A creditor that wants a debt declared non-dischargeable for fraud, the claim a card issuer brings when a borrower ran up charges on the eve of filing, must file its complaint within 60 days after the first date set for the 341 meeting. The court may extend that time only "on a party in interest's motion filed before the time expires." A creditor that never learns the case exists cannot move before a deadline it does not know about. Courts have treated Rule 4007(c) as a claim-processing rule rather than a jurisdictional one, and a few have allowed narrow equitable relief; counsel should assess that, not count on it. The clock runs from the date set for the meeting, not from the date anyone was told.

The proof-of-claim deadline is more forgiving. Under Rule 3002(c), a claim in a chapter 7 or 13 case is timely if filed within 70 days after the order for relief, and paragraph (7) lets the court extend the time by up to 60 days, on a motion filed before or after the deadline, if the notice "was insufficient to give the creditor a reasonable time to file." That is a real relief valve. It is also a motion that has to be filed, case by case, by someone who knows to file it.

For cases filed since October 8, most of these deadlines still lie weeks or months ahead, and a short outage may cost nothing but paperwork. The risk grows with every day the BNC stays dark, and it is concentrated in the cases where a notice never arrives at all. This is not legal advice. It is a list of questions a bank's bankruptcy counsel should be answering this week, and the fact that it falls to each institution to answer them is the point.

The phishing season has already been announced

The courts have seen this coming once before. In November 2024, the Bankruptcy Court for the Southern District of Indiana and others warned of a nationwide campaign of fake Notices of Electronic Filing sent to attorneys and law firms. Recipients who replied received a second email with a link to a malicious website. The courts' advice was to verify cases and documents only through CM/ECF.

Now consider the incentives. Thousands of bankruptcy notices are overdue. Every bank, credit union, servicer and collection agency in the country has a bankruptcy unit whose daily job is to open court-looking PDFs from senders it does not personally know. Debtors' attorneys in some districts have been told to serve notices themselves, by their own means, in formats nobody has standardized. And sometime soon the BNC will come back and send a flood of late notices at once. A message that says "Updated Notice: Bankruptcy Noticing Center service restored, please review the attached notices for your institution" is as plausible as anything a real clerk will send this month. If any data did leave the BNC, the attacker would not even need to guess which institutions are creditors in which cases. That is a hypothesis about what a criminal could do, not a report of anything observed. It is also exactly the kind of lure MITRE catalogs as T1566.001, spearphishing attachment, and T1566.002, spearphishing link.

The defense is boring and it works: treat every bankruptcy notice that arrives outside the institution's established EBN channel as unverified until its case number and docket entry are confirmed in PACER, and tell the bankruptcy unit, today, that the normal channel is down and anything claiming to replace it should be checked twice.

Who else depends on the mailroom

The consumer creditors are the largest constituency, but they are not the only one.

Chapter 11 and subchapter V. The largest chapter 11 cases typically retain a private claims and noticing agent that serves notices itself, so the BNC outage should reach them less. The small business cases often have no such agent. Epiq counted 302 subchapter V elections in August alone, up 63 percent from a year earlier. In those cases, bar dates, plan deadlines and confirmation hearings travel through the same court-generated notices.

Trustees. Chapter 13 trustees in the Middle District of Tennessee are now serving notices the BNC used to serve. Every hour they spend on envelopes is an hour not spent on the cases.

The debtors. The people filing these cases are the ones whose Social Security numbers the creditor notices carry, and whose fresh start depends on creditors learning that the stay is in place. A debtor whose lender never got the notice is a debtor who keeps getting collection calls, and whose lawyer now has to prove when the creditor knew.

The judiciary has been here twice before

On January 6, 2021, the Administrative Office posted "Judiciary Addresses Cybersecurity Breach: Extra Safeguards to Protect Sensitive Court Records." After CISA's warning about SolarWinds Orion, the AO said it was auditing vulnerabilities in CM/ECF that "greatly risk compromising highly sensitive non-public documents stored on CM/ECF," and it ordered that the most sensitive sealed filings be kept on paper or standalone computers: "These sealed HSDs will not be uploaded to CM/ECF." A federal court system went back to paper for its most sensitive records because it could not trust its own case management software.

On August 7, 2025, the AO posted "Cybersecurity Measures Strengthened in Light of Attacks on Judiciary's Case Management System," after Politico reported that the same system had been compromised. Nextgov's account quoted the AO saying the judiciary was "taking additional steps to strengthen protections for sensitive case documents," and reported that congressional staff had received a briefing on July 23 and asked for a classified follow-up.

Six weeks before that, on June 24, 2025, Judge Michael Y. Scudder Jr. of the Seventh Circuit, who chairs the Judicial Conference's Committee on Information Technology, gave a House Judiciary subcommittee the plainest description we have found of the judiciary's own position. His written statement says underinvestment had left the judiciary's major systems "outdated and vulnerable," that "Many are not up to date with modern development standards or security protocols," and that CM/ECF and PACER "are outdated, unsustainable due to cyber risks, and require replacement." It reports that judiciary defenses blocked approximately 200 million harmful events in fiscal 2024. And it names who stands to lose when the courts are breached: among others, "trade and commercial secrets for businesses involved in bankruptcy proceedings."

On August 25, 2025, Senator Ron Wyden wrote to Chief Justice Roberts asking for an independent review by the National Academy of Sciences. Two passages in that letter describe this week better than anything published this week. The first is structural: "executive agencies are subject to minimum federal cybersecurity requirements, while the federal judiciary has not adopted its own set of binding minimum cybersecurity standards that every federal court must follow." The second is about disclosure: "the judiciary still hasn't notified victims whose information was stolen in 2020." The letter also reports, citing Politico, that the 2025 intrusion "exploited unresolved security holes discovered five years ago," and that the AO had only recently announced it would require multi-factor authentication for its case management system by the end of 2025, in a form Wyden said is not phishing-resistant.

Read those four documents and then read the October 15 statement. The judiciary has been told, by its own IT chair, by a senator, and by two prior incidents, that its systems are a target and that its disclosure is thin. This time the system belongs to a contractor, which raises a question the 2021 and 2025 statements never had to answer: what the judiciary requires of the companies that run its infrastructure, and how anyone outside would know.

A contractor with a standing connection to every bankruptcy docket

Go back to the phrase in the Eastern District of Texas notice: "the court polling and certification drop-off process." The Kansas presentation explains it. The BNC reaches into each court's servers to collect the notices and the recipient lists, and when it has sent them it drops a Certificate of Notice back onto the court's server, where it is docketed. Every working day, a contractor-operated system reads from and writes to the case systems of every federal bankruptcy court.

That is a trusted relationship in the precise sense MITRE uses for T1199: a third party with legitimate, standing access into the systems of the organizations it serves. It is the same pattern Cloudskope has written about at managed service providers and software vendors. It is the side door.

We are not saying the side door was used. Nothing public suggests anyone moved from the BNC into a court system, and CM/ECF and PACER answered our requests normally this morning. We are saying the question exists, that it is the most important question for the courts, and that neither the AO nor BAE has addressed it. Were the BNC's polling and drop-off connections cut when BAE notified the AO on October 9? Were the credentials those connections use rotated, or will the BNC come back on the same ones? Have the courts reviewed what the BNC's accounts did in CM/ECF in the weeks before October 8? Given what the judiciary disclosed in 2021 and 2025 about CM/ECF, those are not exotic questions. They are the first ones a bank examiner would ask a bank about its core processor.

The address everyone is told to check shows nothing

Here is the most fixable problem, and it has been fixable since day one.

The BNC's public addresses are names in the judiciary's own DNS zone, uscourts.gov, which is served from Akamai and resolving normally. Each of those names is a CNAME with a time-to-live of 60 seconds. Anyone with authority over the judiciary's zone could point bnc.uscourts.gov and bankruptcynotices.uscourts.gov at a static status page, hosted anywhere, and every resolver in the country would pick up the change within about a minute. Instead, a creditor that does exactly what the Mandatory EBN terms tell it to do, "access this website regularly," gets a DNS failure. Not a maintenance banner. Not a link to the AO statement. Nothing. A week after BAE's report, the official channel's message to its mandatory users is silence.

The lesson underneath is older still. In July 1997, RFC 2182, published as Best Current Practice 16 by Robert Elz, Randy Bush, Scott Bradner and Michael Patton, told operators that "Secondary servers must be placed at both topologically and geographically dispersed locations on the Internet," so that a single failure cannot take all of them down. The BNC's four nameservers sit in two AT&T address blocks. If the BNC network was disconnected on purpose, dispersed DNS would not have kept the service up. It would have kept the names answering, which is what lets an operator put up a notice. That guidance is 29 years old.

None of this is about blame for the intrusion. It is about whether the people who depend on the system can find out what is happening to it. Right now, they find out from roughly ninety separate court websites, one AO statement and one sentence from a BAE spokesperson to a reporter.

The same week, another contractor

The BNC was not the only federal service delivered through a contractor to go down this week. The Record reported that on Wednesday, October 14, the Department of Transportation confirmed that a safety agency's contact center was taken offline after its contractor was hit by a cyberattack. DysruptionHub identified that contractor as Senture, which runs registration phone support for the Federal Motor Carrier Safety Administration. We have found nothing connecting the two incidents and are not suggesting a connection. The pattern is the point: the government buys services from contractors, the services fail when the contractors are hit, and the public learns the details from local notices and trade press.

What the AO and BAE should have done by now

None of these require knowing who did it.

1. Publish one incident page with one timeline. The courts have dated the start as October 8 and October 9. The AO, which BAE notified late on October 9, has published neither. One page, one start date, updated daily.
2. Say what the BNC holds and whether it was reached. The creditor version of the 341 notice is designed to carry the debtor's full Social Security number. The AO should say whether those notices, or their underlying data, were stored on the affected systems, for how long, and whether there is any evidence they were accessed or copied. "We are investigating" is a holding statement, and six days is long enough to hold.
3. Put a status page behind the BNC's names. Sixty-second CNAMEs in a zone the judiciary controls. It is a one-hour change.
4. Tell creditors how the backlog will be dated. When the BNC restarts, will Certificates of Notice show the queue date or the transmission date? Creditors' stay-violation exposure and deadline arguments turn on that answer.
5. Issue national guidance, not ninety orders. The Judicial Conference or the AO should publish one set of recommendations for chief judges on deadlines under Rules 3002(c), 4004(a) and 4007(c), so a creditor's rights do not depend on which district a borrower lives in.
6. Confirm the side door is shut. State that the BNC's polling and drop-off connections into court systems were disabled and that their credentials will be replaced before service resumes.
7. Warn about phishing now. Before the backlog moves, tell creditors and the bar that legitimate notices will arrive through established channels and how to verify anything that arrives any other way.

Seven items. Each one is a communication or a configuration change. As of 2:15 AM Central on October 16, we could find evidence of none.

What boards should be asking this week

For the boards and audit committees of banks, credit unions, card issuers, auto lenders, servicers and collection businesses:

First, does our bankruptcy unit know the BNC is down, and what is it using instead? If the answer is "we have not received any notices this week and assumed it was quiet," that is the finding.

Second, how many of our customers filed for bankruptcy since October 8, and how do we know? Courts' dockets in PACER and commercial bankruptcy data services do not depend on the BNC. Has someone reconciled them against our collections, ACH debits and repossession queues?

Third, which deadlines are at risk? Ask counsel for a list of open matters where a Rule 4007(c) complaint or a proof of claim deadline could pass before a notice arrives, and whether motions should be filed now, before time expires.

Fourth, has the bankruptcy unit been warned about fake notices? It opens court-looking attachments for a living, and its normal channel is down.

Fifth, if the AO later says notice data was accessed, what do we owe our customers? It would not be our breach. It would be our customers' Social Security numbers, paired with our name as their creditor. Decide now who would make that call.

And one question for every board, financial or not: where else does a single contractor sit between us and a legal obligation, with no second channel? Court noticing is one. Garnishment and levy processing, subpoena portals, and regulatory filing systems are others.

For sponsors, lenders and acquirers

Private equity owns many of the businesses this outage reaches: consumer lenders, servicers, collection agencies, debt buyers, legal services firms, and the software platforms that ingest bankruptcy data for all of them. Three things belong in the next portfolio review and the next diligence request list.

Ask each consumer-credit portfolio company how bankruptcy notices enter its systems, through EBN, NCRS, a data vendor or the mail, and what happened to that flow this week. A company that cannot answer quickly has a control gap that will show up again.

Ask for the stay-violation and dischargeability exposure created by the outage, and how it will be reported. Unwinding post-petition collections costs money even where section 342(g) blocks penalties.

For distressed and special-situations investors, note that the outage reaches small business cases, including subchapter V cases, more than mega-cases with private claims agents. Bar dates and plan deadlines in those cases depend on the same court-generated notices. Claims purchased this month should be checked against the docket, not against whatever notice did or did not arrive.

Cloudskope advises boards and deal teams on exactly this scenario: a single vendor, sitting between a regulated business and its legal obligations, that fails without warning and explains itself slowly.

What we are not saying

We are not saying any data was stolen from the BNC. Nobody has said so and nobody has claimed it.

We are not saying who is responsible. We found no leak-site claim and have no basis to attribute the incident.

We are not saying BAE Systems was negligent. We do not know how the intrusion happened. The evidence we gathered is consistent with BAE's statement that the incident is isolated to the BNC, and with a fast decision to disconnect it.

We are not saying anyone moved from the BNC into court systems. We are saying the BNC has a standing connection to them and that the public record does not say whether it was cut.

We are not saying the October 8 and October 9 start dates are inconsistent with each other in any way that matters to the investigation. They are inconsistent with each other in a way that matters to creditors, and only the AO can reconcile them.

We are not saying the 2020, 2025 and 2026 incidents are connected. They are three incidents at one institution, and the institution's own disclosures are the subject.

We are not giving legal advice. Creditors with deadlines at stake should be talking to bankruptcy counsel today. If the AO or BAE would like to correct anything on this page, it will be updated the same day.

Our record of these incidents

• BAE Systems Bankruptcy Noticing Center Cyber Incident 2026, the verified timeline and running list of unknowns
• Frost Bank and the New Vendor-Risk Reality
• Audited. Compliant. Hacked Anyway.
• Conduent Data Breach 2025, another government services contractor
• CDK Global Breach 2024, when one vendor's outage became an industry's outage
• SolarWinds Breach 2020, the incident behind the judiciary's January 2021 statement
• Elsevier Was the Name on the Page. RELX Was the Pattern.

Sources

• Administrative Office of the U.S. Courts, Cybersecurity Incident Disrupting Bankruptcy Court Operations, October 15, 2026
• Jonathan Greig, The Record from Recorded Future News, Federal bankruptcy courts dealing with outages after contractor cyberattack, October 15, 2026
• DysruptionHub, Cyber incident halts U.S. bankruptcy court notices nationwide, October 15, 2026
• U.S. Bankruptcy Court, E.D. Tex., BNC Service Disruption Notification, October 13, 2026
• U.S. Bankruptcy Court, S.D. Ind., Bankruptcy Noticing Center Service Interruption, and General Order 26-0003, October 13, 2026
• U.S. Bankruptcy Court, E.D.N.Y., Bankruptcy Noticing and Service Disruption, October 13, 2026
• U.S. Bankruptcy Court, S.D.N.Y., Bankruptcy Noticing Center Update, October 13, 2026
• U.S. Bankruptcy Court, M.D. Ala., Nationwide Bankruptcy Noticing Center Outage, October 2026, October 13, 2026
• U.S. Bankruptcy Court, N.D. Ga., Notice of Bankruptcy Noticing Center Service Outage, October 13, 2026
• U.S. Bankruptcy Court, M.D. Tenn., Bankruptcy Noticing Center Service Disruption, October 14, 2026
• U.S. Bankruptcy Court, N.D. Fla., Administrative Order No. 26-003, October 14, 2026
• U.S. Bankruptcy Court, S.D. Ga., Important Information Regarding Bankruptcy Noticing Center (BNC) Nationwide Service Disruption, October 15, 2026
• Bankruptcy Noticing Center, Mandatory EBN (offline at publication; read from cache)
• David D. Zimmerman (Clerk, D. Kan.) and BNC project management (deck copyright BAE Systems), CLE on the BNC and U.S. Service, U.S. Bankruptcy Court, D. Kan., March 26, 2025
• Susan M. Thurston, ABI Journal, Are You Receiving Notice of a Bankruptcy Filing as Soon as You Could Be?, October 2002
• Judicial Conference of the United States, Official Form 309A and Official Form 309 Committee Notes
• Federal Rules of Bankruptcy Procedure 2002, 3002, 4007 and 9006; 11 U.S.C. 342 (Legal Information Institute)
• Brianna Wilson, ABF Journal, Epiq AACER: Total Bankruptcy Filings Increase 8% Y/Y in August, September 8, 2026
• Hon. Michael Y. Scudder Jr., Statement to the House Judiciary Subcommittee on Courts, Intellectual Property, Artificial Intelligence, and the Internet, June 24, 2025
• Sen. Ron Wyden, Letter to Chief Justice John G. Roberts Jr., August 25, 2025
• Administrative Office of the U.S. Courts, Cybersecurity Measures Strengthened in Light of Attacks on Judiciary's Case Management System, August 7, 2025, and Judiciary Addresses Cybersecurity Breach: Extra Safeguards to Protect Sensitive Court Records, January 6, 2021
• David DiMolfetta, Nextgov/FCW, US court system to boost cyber posture after hack of electronic case management tool, August 8, 2025
• U.S. Bankruptcy Court, S.D. Ind., Warning of Nationwide Notices of Electronic Filing Scam, November 7, 2024
• R. Elz, R. Bush, S. Bradner and M. Patton, RFC 2182 / BCP 16: Selection and Operation of Secondary DNS Servers, July 1997
• MITRE ATT&CK, T1199 Trusted Relationship, T1566.001 Spearphishing Attachment and T1566.002 Spearphishing Link
• Cloudskope first-hand checks (DNS over HTTPS via Google, Cloudflare and Quad9; ARIN and domain RDAP; crt.sh; ransomware.live), October 16, 2026, 1:55 to 2:15 AM Central