BAE Systems Cyber Incident Takes U.S. Bankruptcy Noticing Center Offline for a Week
What Happened — A cyber incident at BAE Systems Inc., the contractor that operates the Bankruptcy Noticing Center (BNC) for U.S. federal courts, forced the BNC platform offline on October 9. All public‑facing domains (bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, etc.) and the National Creditor Registration Service were unavailable, halting the generation and distribution of bankruptcy notices nationwide.
Why It Matters for Trust & Control Assurance
- The outage illustrates the risk of a single‑point‑of‑failure in a third‑party‑provided critical service – a scenario continuous control‑assurance programs are built to detect, monitor, and evidence.
- Demonstrates the need for documented vendor‑oversight controls (contractual SLAs, incident‑response coordination, and real‑time monitoring) that can be presented as audit evidence across frameworks.
- Highlights the importance of a defensible incident‑response and business‑continuity plan that includes rapid evidence collection and stakeholder communication.
Who Is Affected – Federal judiciary (U.S. bankruptcy courts), law firms and attorneys relying on electronic notices, and any creditors awaiting court communications.
Recommended Actions
- Map the incident to your vendor‑risk management control area and verify that contractual monitoring and SLA reporting are in place.
- Collect and preserve logs, communications, and remediation evidence to support audit readiness.
- Review and test your business‑continuity procedures for third‑party service failures, ensuring alternate notification channels are documented.
Technical Notes — The public statement does not disclose the attack vector, malware, or any CVE. The incident is isolated to the BNC system operated by BAE Systems; no data breach has been confirmed. Source: Security Affairs