A cybersecurity incident has impacted BAE Systems IT and websites that support the Bankruptcy Noticing Center and halted the production and distribution of bankruptcy notices for federal bankruptcy courts, according to the federal judiciary.
The Administrative Office of the U.S. Courts published a notice on October 15 explaining that the Bankruptcy Noticing Center produces and transmits bankruptcy notices for all federal bankruptcy courts, and that BAE Systems operates those systems and websites on behalf of the judiciary. All access to the systems BAE operates is unavailable, including bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov and the National Creditor Registration Service.
The notice says the Administrative Office has been in communication with the affected courts and is coordinating with BAE Systems, and that BAE is actively investigating and working to restore operations. The notice does not say what caused the incident, when it began, whether any data was accessed or when service will return.
The noticing function sits in a single vendor-operated environment that every federal bankruptcy court uses, so one outage reaches all of those courts together. In our reading, the case belongs with the other third-party incidents where one operator’s problem became many customers’ problem, such as the iRhythm disclosure about third-party-hosted business apps.
Organizations that depend on outsourced operators can act on that before an incident. List which outside operators run a function you could not do without for a week, and agree in advance how you would learn of an outage and what manual process would cover it. The exposure inventory is a natural place to record the answer.
Source: U.S. Courts, Cybersecurity Incident Disrupting Bankruptcy Court Operations
