BAE Systems cyberattack knocks out US bankruptcy notices
A cyberattack on defense contractor BAE Systems has taken down the system that every federal bankruptcy court in the United States relies on to send out case notices.
The Administrative Office of the U.S. Courts, the agency that provides administrative support to the federal judiciary, confirmed the disruption in a statement released on Thursday afternoon. The affected platform is the Bankruptcy Noticing Center (BNC), which BAE Systems runs on behalf of the judiciary. It produces and transmits bankruptcy notices for all federal bankruptcy courts.
Websites and notice production offline
According to court officials, all access to the BNC systems and to the websites BAE operates for the judiciary is currently unavailable. The bankruptcy noticing process is also down. The outage covers several domains and services:
- bnc.uscourts.gov
- bankruptcynotices.uscourts.gov
- notices.uscourts.gov
- the National Creditor Registration Service
As a result, no bankruptcy notices are being produced at the moment.
"The Administrative Office of the U.S. Courts has been in communication with the impacted courts and is also coordinating with BAE Systems. BAE is actively investigating this incident and working to restore operations," officials said.
The office did not answer questions about what kind of attack hit the system or whether any data was stolen.
BAE says the incident is contained to BNC
BAE Systems is a British multinational and one of the largest defense contractors in the world. It has deep ties to the U.S. government and supplies aerospace, weapons and information security services to several federal departments.
A company spokesperson said BAE is "aware of a security incident that is isolated to the BNC system and have taken immediate steps to address it." The spokesperson added that the company is "coordinating closely" with the Administrative Office of the U.S. Courts on the response.
The Cybersecurity and Infrastructure Security Agency (CISA), which usually handles cyberattacks on federal agencies, referred questions to the U.S. Courts. The FBI did not respond to requests for comment.
Not the first hit on the court system
The judiciary has been a repeated target. The federal courts' docketing system was attacked by hackers in early 2020. Last year, federal court officials said they were working to improve online security for sensitive documents and case files. That effort followed a major hack of the courts' case filing system, which officials feared had exposed the identities of confidential informants in criminal cases.
State courts have been hit too. Only weeks before the BNC outage, Arizona's state court system was breached, and information belonging to more than 1.3 million people was leaked.
The incident also lands during a rough stretch for the U.S. government more broadly. Recent weeks have brought cyberattacks involving the Defense Department and the FBI. On Wednesday, the Department of Transportation confirmed that a contact center run by one of its safety agencies was temporarily taken offline after a contractor suffered a cyberattack.
Our Take
The BNC outage is another example of how a single contractor can become a single point of failure for an entire branch of government. One vendor-run system handles notices for every federal bankruptcy court, so one incident at that vendor stops the process nationwide. The Department of Transportation case from the same week follows a similar pattern, which suggests that attackers, or at least the consequences of their attacks, are increasingly reaching government services through third parties rather than through agencies directly.
For readers in legal, financial and public sector roles, the bigger concern is the data. Bankruptcy notices go to debtors, creditors and their lawyers, and they contain personal and financial details. Neither the courts nor BAE has said whether anything was taken. Given the recent leak from Arizona's courts and incidents such as the Legal Aid Agency breach in the UK, it would be prudent for anyone involved in recent bankruptcy cases to watch for targeted phishing aimed at legal workflows, including fake notices that try to exploit the gap left by the outage.
It is worth watching whether BAE discloses the type of attack, whether a ransomware or extortion group claims responsibility, and how long the courts take to restore noticing. Lawmakers may also ask how a contractor with this level of access to government systems was compromised, and whether the judiciary's security upgrades extend to the vendors it depends on.