What actually broke
The Administrative Office of the US Courts disclosed on October 15 that the Bankruptcy Noticing Center, the system that produces and transmits legally required notices for every federal bankruptcy case in the country, went down nationwide. Four systems were listed as unavailable: bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service. Production of bankruptcy notices stopped entirely. For a court system that runs on strict statutory notice deadlines, that is a process with legal consequences sitting idle, not a cosmetic outage.
The contractor behind the BNC is BAE Systems, the British defense and aerospace giant that is deeply embedded in US government IT and services work. The Administrative Office said BAE is actively investigating and working to restore operations, and that the two organizations are coordinating on the response. A BAE spokesperson confirmed awareness of a security incident isolated to the BNC system and said immediate steps had been taken to address it. Neither side has said what kind of incident this is or whether any data left the system.
Why a defense contractor runs bankruptcy notices
This is the part that should make every CTO pause. BAE Systems is known in most people's minds for fighter jets and naval systems, not administrative mail processing for consumer bankruptcy filings. But large defense and government services contractors routinely win unglamorous back-office contracts precisely because they already hold the security clearances, compliance certifications, and contracting vehicles that make them easy for an agency to hire without a fresh competitive bid. The result is concentration you would never predict by looking at the vendor's primary business.
That pattern is not unique to the federal courts. Enterprises do the same thing constantly: a payroll processor also runs your benefits enrollment, a logistics vendor also runs your returns portal, a core banking provider also runs your fraud alerts. The function that looks like a commodity add-on is often running on the same infrastructure and the same security posture as the vendor's flagship, higher-scrutiny business, which means a breach anywhere in that vendor's stack can take down a service you never thought to classify as critical.
The silence is the story
Three days after disclosure, the public record is remarkably thin. The Administrative Office has not answered questions about the nature of the incident or whether data was stolen. BAE's statement is carefully scoped to say the incident is isolated to the BNC system, language that is doing real work: it tells you the company has a view into its own network segmentation good enough to make that claim, but it does not tell you how it verified that view, or over what time window.
The FBI did not respond to requests for comment and CISA referred inquiries back to the US Courts. That routing is standard practice for an incident still under investigation, but it also means there is currently no independent confirmation of scope. If you are a creditor, a debtor's attorney, or a court officer relying on BNC notices for statutory deadlines, you are operating on faith that the contractor's internal assessment is accurate, with no external validation yet available.
What nationwide notice failure actually costs
Bankruptcy notices are not a nice-to-have communications feature, they are the mechanism that satisfies due process requirements for creditors and parties in interest. When the BNC goes dark, courts either delay cases to stay compliant with notice requirements, or they risk procedural challenges later from parties who claim they were not properly notified. Neither option is good, and both create downstream cost: delayed case resolution hurts debtors trying to get a fresh start, and improperly noticed creditors have grounds to reopen matters that should have been settled.
For a retail or commerce business, the parallel is any legally mandated notice function you have outsourced: data breach notification vendors, credit reporting dispute processors, product recall notice services. If that single contractor goes down, you do not get to simply pause your legal obligations, you inherit the liability of a missed deadline that your vendor's outage caused. Few companies have asked their vendor what their actual recovery time objective is for exactly this scenario, as opposed to the recovery time objective in the contract.
The vendor risk register question this raises
Most vendor risk assessments weight criticality by data sensitivity and by how core the vendor's product is to daily operations. A mailing and notice system scores low on both axes, which is exactly why it rarely gets the scrutiny of, say, a payment processor or an identity provider. This incident argues for a third axis: statutory or contractual consequence of downtime, independent of data sensitivity. A system that produces legally required notices can be low-sensitivity and still be high-consequence if it stops.
CTOs and CISOs running vendor risk programs should pull the list of any function in their own environment that exists purely to satisfy a legal notice, disclosure, or compliance deadline, and check who operates it, whether that operator has disclosed a tested failover, and whether the contract actually specifies a recovery time objective with a financial penalty attached. If the answer is a shared infrastructure with the vendor's larger, higher-profile business and no tested standalone failover, that is the gap this incident just made visible for free.
What to do before your own version of this happens
Start with an inventory, not a technology fix. List every externally hosted system in your stack whose only job is to satisfy a legal, regulatory, or contractual notice obligation: breach notifications, billing disclosures, compliance mailings, recall notices. For each one, get a written answer from the vendor on three things: what happens to your legal deadline if their system is down, what their actual tested recovery time is, and whether that system shares infrastructure with any other part of their business that might be a more attractive target.
Then treat any vendor who cannot answer those three questions clearly as a risk item regardless of how boring their product looks. The BNC incident is a useful forcing function precisely because it is so unglamorous: nobody budgets extra diligence for a notice mailer, until the day the notice mailer is the reason a legal deadline gets missed nationwide. Use this one, free of charge, as the reason to ask the question internally before your own contractor becomes the next headline.
