On 15 October 2026 the Administrative Office of the U.S. Courts said a cyberattack on contractor BAE Systems had taken down the Bankruptcy Noticing Center (BNC), the system that produces and transmits notices for every federal bankruptcy court. According to The Record, the websites bnc.uscourts.gov, bankruptcynotices.uscourts.gov and notices.uscourts.gov went offline, along with the National Creditor Registration Service, and notice production stopped. The incident exposes a structural weakness in how government runs critical functions. It does not, on current evidence, call for a rushed new regulatory regime.
What we know, and what we don't
The confirmed facts are narrow. The judiciary says BAE is investigating and working to restore operations. BAE says the incident is "isolated to the BNC system." The judiciary has not said what kind of attack it was, when it began, or whether data was stolen, and no restoration timeline has been given, according to Infosecurity Magazine. Any analysis that assumes ransomware or a nation-state actor is guesswork. This piece does not make that assumption.
Why a notice outage is a legal problem, not just an IT problem
Bankruptcy notices are not courtesy mail. They tell creditors that a debtor has filed, that deadlines are running, and that their rights may be affected. The judiciary's own noticing page explains that under Mandatory Electronic Bankruptcy Noticing, an entity that is mailed 25 or more paper notices in a month is moved to electronic service. After a transition period, those recipients get notices only through a BNC-hosted account, and the page says use of the BNC website constitutes notice in cases where they are a party.
That design is efficient, and it concentrates risk. When the one hosted channel goes dark, creditors cannot reliably see deadlines. Courts must decide case by case how to treat missed or delayed notice. Those who bear the cost are mostly ordinary creditors, small businesses and consumers, not the firms with in-house bankruptcy counsel.
The case for tougher mandates
The strongest argument for stricter rules runs like this. Government has outsourced core functions to a small set of vendors. Voluntary practices have not produced uniform resilience. This outage follows other incidents The Record lists: an Arizona state court breach that exposed data on more than 1.3 million people, and a Department of Transportation contact center taken offline on 14 October by a contractor attack. After the 2025 breach of the PACER filing system, federal courts moved to tighten security for sensitive filings. Repeated incidents suggest that guidance alone is not enough, and mandatory incident reporting would at least give defenders and affected parties timely facts.
That argument has real force on one point: transparency. Creditors, trustees and lawyers are working without basic information about the cause or the duration of the outage.
Where the mandate argument falls short
The existing reporting framework is a useful test case. Congress passed the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), which will require covered entities to report covered incidents to CISA within 72 hours of reasonably believing one occurred, and ransom payments within 24 hours. As CISA's CIRCIA page states, the final rule is not yet in effect. CISA published its proposal on 4 April 2024, closed comments on 3 July 2024, and held town halls on 15 to 18 June 2026, while citing multiple funding lapses that affected the rulemaking. Until the rule takes effect, reporting is voluntary.
So the immediate problem is not a lack of ideas for rules. The existing rule has taken more than four years since enactment to finalize, and the agency charged with it has been disrupted by funding gaps. Piling on new contractor-specific mandates before the first one works would add compliance cost without evidence that it improves outcomes. Compliance burden also falls hardest on smaller vendors, which can reduce the pool of competitors willing to serve government and make concentration worse.
What proportionate action looks like
The policy levers that fit this incident are mostly contractual and operational, and they work faster than rulemaking.
- Fallback channels written into contracts. Where a hosted service is the legally operative channel, the contract and court procedure should require a tested manual or alternative path, such as mail or a mirrored portal, that can run within days.
- Prompt public incident updates. Without exposing sensitive forensic details, agencies can tell affected parties what is down, since when, and what to do about deadlines. Disclosure of this kind needs no new statute.
- Resilience testing as a procurement criterion. Agencies can ask vendors to demonstrate recovery times, not just attest to controls. That rewards good security rather than paperwork.
- Finish CIRCIA before layering more. A clear, narrowly scoped final rule gives the whole ecosystem one predictable standard. Funding stability for CISA matters as much as the text.
There is also an open-internet dimension. Governments that respond to incidents with broad data-localization or vendor-ban reflexes tend to reduce, not increase, security. Resilience comes from redundancy, diversity of suppliers and quick information sharing, all of which a proportionate, evidence-based approach preserves.
Bottom line
The BNC outage is a reminder that a legal process can be only as reliable as its weakest hosted component. The right response is to harden and diversify those components and tell the public what is happening, then let the long-delayed CIRCIA rule do the work it was designed for. Once the facts of this incident emerge, any further reform should follow from what actually failed.