1. Executive summary
A cybersecurity incident at BAE Systems has taken down the Bankruptcy Noticing Center (BNC), the system that generates and sends notices for every federal bankruptcy court in the United States, and the outage has run for a week with no restoration date. The Administrative Office of the US Courts says all BAE-operated BNC systems and websites are unavailable, and the National Creditor Registration Service is offline, so filers cannot generate creditor mailing lists. Neither BAE nor the judiciary has stated the cause, confirmed it was an attack, or said whether data was compromised. No CVE, no exploitation status, and no CISA KEV entry apply: this is a third-party service-availability incident, not a vulnerability with a patch. For EMEA financial services the direct exposure is limited to institutions that are creditors in US bankruptcy proceedings or that depend on BNC-derived notice data, but the case is a live example of concentration risk in a single outsourced provider, which is the part that matters to your DORA third-party and incident-reporting obligations.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28: ICT third-party risk, general principles | A single contractor, BAE Systems, operates the BNC for the entire US federal judiciary, and its failure stopped notice generation nationwide. | If you rely on BNC output or on a comparable single-provider noticing or court-data function, this is the scenario your third-party risk register is meant to capture. Confirm whether any of your own critical or important functions sit behind one provider with no tested fallback. |
| DORA Art. 29: preliminary assessment of ICT concentration risk | The BNC is a sole-source function: one contractor, one system, no stated alternate path for notices. | Assess whether your exposure to BAE-operated services, or to any equivalent sole-source provider, constitutes concentration risk you have not yet documented. |
| DORA Art. 30: key contractual provisions with ICT third-party providers | BAE has not disclosed cause, scope, or a restoration date, and the courts have no estimated return to service. | Check that your contracts with providers of critical or important functions oblige them to notify you of incidents and to give you the information you need to meet your own reporting duties. If they do not, that gap is the finding. |
No NIS2 or UK NIS article is engaged by the facts available here. The incident is US-based, the affected operator is a US defence and services contractor, and nothing in the source establishes an EMEA entity, an EMEA service, or an EMEA supply-chain link that would trigger NIS2 Art. 21(2)(d) or Art. 23, or UK NIS 2018 duties.
3. Technical analysis & attack chain
The source material does not describe an attack chain. It reports an outage and the operational consequences. What follows is the confirmed sequence of events, not a reconstruction of how the intruder got in.
- Late on October 9, BAE Systems told the Administrative Office of the US Courts that it had a problem. The disruption affected both BAE's notice-processing systems and the BNC websites.
- On October 13, several bankruptcy courts posted notices describing a service disruption or interruption. None of those notices mentioned a cybersecurity incident.
- By the time of the Administrative Office statement, all access to the BNC systems and websites that BAE operates on behalf of the judiciary, and the related bankruptcy noticing process, were unavailable.
- The National Creditor Registration Service went offline with the rest. While it is down, users of the courts' electronic filing system cannot generate the creditor mailing lists they normally use to serve documents.
- Paper and electronic notices issued through the center since October 9 have not been delivered. Electronic filing notifications to registered attorneys, trustees, and the US Trustee are still going out, and courts continue to accept filings and open new cases.
- No restoration date has been given.
What is not established: the initial access vector, the exploited component, any malware, persistence, privilege escalation, command-and-control, lateral movement, or data access. BAE has not said what caused the incident, whether it was a cyberattack, or whether any data was compromised. A BAE spokesperson told The Record the company is "aware of a security incident that is isolated to the BNC system" and that it responded immediately and is working with the Administrative Office. That isolation claim is BAE's own, single-sourced, and unverified by any third party.
The one technical fact worth holding onto is the shape of the failure. A contractor-operated system that handles notice generation for every federal bankruptcy court went fully offline, including its public websites, and stayed offline for a week. That is consistent with either a destructive intrusion or a defensive shutdown taken deliberately to contain one. The source does not let you distinguish between the two, and no reporting has.
Attribution: none. No actor is named in the source material, and the verified reference data contains no MITRE ATT&CK profile for any actor in connection with this incident. Any attribution you see elsewhere is unconfirmed.
4. Mitigation & containment
This is a third-party availability incident. The actions below are about your exposure to the outage and to the provider, not about patching anything on your estate.
P1, within 24 hours
- Identify every business process that consumes BNC output, National Creditor Registration Service data, or creditor mailing lists generated through the courts' electronic filing system. Confirm with the process owners whether any deadline, filing, or client obligation depends on a notice that has not been delivered since October 9.
- If you are a creditor in a US bankruptcy proceeding, treat notices issued on or after October 9 as undelivered. Check the docket directly through PACER or the relevant court rather than waiting for a BNC notice. Do not assume a missed deadline will be excused.
- Ask your BAE Systems account contact, if you have one, for a written statement on whether any of your data sits in the affected BNC environment and whether the isolation claim extends to services you consume.
P2, within 72 hours
- Pull the contract and the exit or continuity plan for any provider that operates a critical or important function on your behalf as a sole source. For each, record whether the contract obliges the provider to notify you of an incident within a defined window and to give you enough detail to meet your own regulatory reporting duties.
- Where a critical or important function has no tested alternate path, document that as an open concentration risk. DORA Art. 29 assessment is the mechanism; the finding is the absence of a fallback, not the incident itself.
P3, within 7 days
- Add third-party service-availability incidents to your incident taxonomy if they are not already there. An outage at a provider that never touches your network can still stop a regulated process, and your classification process under DORA Art. 18 should be able to catch that.
- Re-run your third-party register against the question this incident raises: which of your providers could go dark for a week without a public explanation, and what would you tell your regulator in that week?
5. Indicators of compromise
No indicators of compromise available in the source material. The source names no hashes, domains, IP addresses, file paths, registry keys, or command lines, and none should be inferred.
Behavioural indicators, from the reported operational effects:
| Behaviour | Where to observe | Confidence |
|---|---|---|
| BNC notice generation and BNC websites unavailable | BNC service status; court notices | Confirmed by the Administrative Office statement |
| National Creditor Registration Service offline, creditor mailing lists cannot be generated | Courts' electronic filing system | Confirmed by the Administrative Office statement |
| Notices issued on or after 2026-10-09 not delivered | Court dockets versus expected notice traffic | Confirmed by court warnings |
| Electronic filing notifications to attorneys, trustees, and the US Trustee still functioning | Courts' electronic filing system | Confirmed by court statements |
6. Detection
Insufficient indicators to author detection rules. The source provides no file artefacts, command lines, registry keys, process behaviour, or network indicators. The only observable effects are the availability of BAE-operated BNC services, which is a service-monitoring concern rather than a detection-rule target.
7. Sources
- SecurityWeek, "BAE Systems Security Incident Stalls Notices From US Bankruptcy Courts", https://www.securityweek.com/bae-systems-security-incident-stalls-notices-from-us-bankruptcy-courts/, 2026-10-16. This is the only source provided. Every factual claim in this advisory rests on it, including the Administrative Office statement, the BAE spokesperson comment to The Record, the October 9 notification date, and the October 13 court notices. Treat the whole item as single-sourced.
8. Adverse Trace position
We assess this as a service-availability incident with unconfirmed cause and no attribution, and we are not raising a severity rating on it for EMEA financial services clients because the source does not establish an EMEA nexus, a data compromise, or a technical exposure you can act on today. The client impact is indirect and specific: if you are a creditor in a US bankruptcy proceeding, notices have not been delivered since October 9 and you should be checking dockets directly. The part we will keep working is the third-party angle. We will watch for a cause statement from BAE or the Administrative Office, for any confirmation of data compromise, and for any named actor, and we will reissue if the picture changes. Clients who consume BAE-operated services beyond the BNC should tell their Adverse Trace contact so we can scope that separately.
Published via PulseTrace — Adverse Trace threat intelligence.