BAE Systems Has Stopped Every Federal Bankruptcy Notice for a Week. When Will They Start Again?

Since 9 October, no federal bankruptcy notice has been produced or delivered anywhere in the United States. The Bankruptcy Noticing Center, which generates and transmits those notices for every federal bankruptcy court, has been unavailable for about a week, and as of today no restoration date has been announced. The Administrative Office of the U.S. Courts says all access to the BNC systems and websites that BAE Systems operates on the judiciary's behalf is unavailable, including bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov and the National Creditor Registration Service. That is not a website outage. It is a stopped core function of the courts, and the silence surrounding it has now lasted longer than most people would tolerate from a utility.

The operational facts are stark enough on their own. Bankruptcy notices carry deadlines and creditor communications; when they stop, lawyers, creditors and debtors can miss time-sensitive steps in live cases. The disruption began on 9 October, when BAE Systems informed the judiciary that systems supporting the BNC were experiencing problems, and several bankruptcy courts warned that official notices could be delayed. A week later, several of the affected sites remain offline. BAE Systems says the incident is isolated to the BNC system, that it took immediate steps to address it, and that no other systems were affected. The Administrative Office says BAE is investigating and working to restore operations. Those statements may all be true. They are also, collectively, almost content-free.

Consider what the public still does not know. Was this ransomware, an intrusion, or something else entirely? Were any bankruptcy case data accessed or exfiltrated, or was the impact limited to availability? Who, if anyone, is responsible? How are courts and parties meant to handle notice deadlines while the system is down? And what oversight or contingency arrangements exist for the judiciary's reliance on a single defence contractor for this function? None of these questions has been answered. The absence of a restoration date is the most telling omission of all: it suggests that either the recovery is not yet understood, or that those who understand it have decided the public does not need to.

That decision is the governance failure. A cybersecurity incident is not a scandal; incidents happen, and the response to them is difficult. But a week of nationwide downtime in a judicial function, with no public explanation of the incident's nature and no estimate of when notices will resume, is a choice about accountability. The judiciary is a public institution, and bankruptcy noticing is a public function, even when it is performed under contract. The contractor's commercial instincts toward silence should not govern how much the public is told about a service the courts cannot currently deliver. At a minimum, the judiciary and BAE Systems can say what category of incident this is, whether data was affected, what interim arrangements courts and parties should follow, and when they expect to publish a restoration estimate. None of that requires naming an attacker or disclosing a vulnerability.

The strongest case against this position deserves a fair hearing. Investigating a live cybersecurity incident often requires withholding technical details so that attackers cannot exploit them, and premature disclosure could slow recovery or expose vulnerabilities that remain unpatched. Security teams frequently do not know the full scope of an intrusion in the first days, and a restoration date offered too early can be wrong, eroding trust further. On this view, silence is not obstruction but operational discipline, and critics demanding details are asking responders to choose between transparency and recovery.

That argument justifies withholding technical specifics. It does not justify withholding everything. There is a wide gap between publishing indicators of compromise and confirming whether the incident is a ransomware event, whether case data was accessed, and what parties should do about deadlines. The first is genuinely dangerous to disclose mid-investigation; the second is basic public information. Nor does the difficulty of estimating recovery times excuse saying nothing at all; an institution can say that it does not yet know without saying nothing. The distinction matters because the current posture treats all information as equally sensitive, which in practice means the public learns nothing until the incident is over, if then.

The deeper issue is dependency. The episode shows how a single contractor's compromise can interrupt a nationwide court function even while other electronic filing systems remain operational. That concentration is a design choice, and it carries a corresponding obligation: if the judiciary is going to route every bankruptcy notice through one defence contractor, it must be able to tell the public, promptly and specifically, when that contractor fails. A week of downtime with no restoration date and no explanation of the incident's nature is not caution. It is a governance failure, and the judiciary and BAE Systems owe the public a fuller account of what happened and when notices will resume.