What happened
The Administrative Office of the US Courts has taken the Bankruptcy Noticing Center offline after what it calls a cybersecurity incident. The center produces and distributes the electronic and paper notices that keep bankruptcy cases moving, including the notices creditors receive when a case is filed.
BAE Systems operates those systems and websites on behalf of the Federal Judiciary. The sites affected include bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov and the National Creditor Registration Service. According to the Eastern District of Texas bankruptcy court, the problems began around October 9, several days before the national notice went out.
Courts are still accepting filings and processing documents, but the entry and service of notices and orders is delayed. The Eastern District of Texas issued a general order extending, by an additional 30 days, the stay delay for any case filed on or after September 14 with an active motion to stay. In other words, a statutory clock moved because a vendor system went down.
A BAE spokesperson told The Register that the incident is isolated to the Bankruptcy Noticing Center, that immediate steps were taken to address it and that the company is coordinating with the Administrative Office on the response. The disruption lands in a rough season for public sector systems, after ShinyHunters' attack on the FBI in September and a confirmed intrusion into the Arizona Judicial Branch's court systems around the same period.
Why this is a GRC story
Concentration risk is a live operational fact. One contractor runs the noticing system for bankruptcy courts nationwide. A supplier register that records name, contact and contract value tells you nothing about that. The questions that matter are which business services depend on the supplier, how long the organization can function without them, and who owns the fallback.
Manual workarounds are a control, and they need to be rehearsed. Courts fell back to paper and local orders, which is the right instinct. Whether that fallback was documented, staffed and time bounded is a different matter. A continuity plan that exists only as a document tends to be discovered, not executed, on the day it is needed, and the 30 day extension suggests the workaround had real cost.
Deadlines do not pause for an incident. Bankruptcy has statutory notice requirements with consequences attached. When the technology that satisfies an obligation fails, the obligation moves to the people who can still act, and the governance question becomes who has authority to adjust timelines and how that decision is recorded. The Eastern District answered that in public, which is more than many organizations manage.
What to watch
Watch for the restoration timeline and for any disclosure about the scope of data touched, since the National Creditor Registration Service holds creditor details. Watch as well for congressional interest in how the judiciary contracts for critical systems, because the answers usually cover right to audit, incident notification windows and exit provisions. For anyone running a supplier risk program in the private sector, the transferable lesson is to test one question this quarter: if your single most embedded vendor went dark for a week, which regulatory deadlines slip, and who is authorized to say so.
Attribution: Analysis based on The Register and related public reporting. This article is original commentary, not a repost of the source material.