CSIPE

Published

- 22 min read

The Bankruptcy Notice System Is Down, but Your Case May Still Be Moving

Cyber Incidents Scam Awareness Online Safety Consumer Rights

Books by the author

Compare all 5

As an Amazon Associate I earn from qualifying purchases. Buying through these links costs you nothing extra and helps pay for the blog.

A bankruptcy case can keep moving while the letter that tells you about it does not. That uncomfortable gap opened across the United States this month after a cyber incident affected the contractor-run system that produces and sends notices for federal bankruptcy courts.

The practical lesson is smaller than the national headline. If you are a debtor, creditor, employee owed wages, landlord, former customer, or anybody else involved in a bankruptcy case, do not assume that silence means nothing happened. Check the official case record or speak to your lawyer and the court through contact details you found yourself. At the same time, do not let an alarming email push you into paying money or handing over a password merely because it mentions a real case.

As of 18 October 2026, the public record supports a service disruption and a cybersecurity incident. It does not establish that every bankruptcy court system was hacked, that every case deadline stopped, or that personal data was stolen. Those distinctions matter because the right response is careful verification, not panic.

What happened to the notice system

On 15 October 2026, the Administrative Office of the U.S. Courts said that information technology and websites supporting the Bankruptcy Noticing Center had been affected by a cybersecurity incident. BAE Systems operates those systems for the federal judiciary. The center, usually shortened to BNC, produces and transmits court notices for federal bankruptcy courts across the country.

The judiciary’s announcement named four unavailable services: the main BNC site, the Electronic Bankruptcy Noticing site, the notices site, and the National Creditor Registration Service. It also said the incident had halted the center’s production and distribution of bankruptcy notices. BAE was investigating and working to restore operations, while the Administrative Office coordinated with affected courts.

The national announcement arrived after district courts had already begun warning users about a service problem. Notices from several courts date the disruption to 9 October. The Middle District of Pennsylvania, for example, said on 14 October that it would continue accepting filings, opening cases, processing documents, and holding hearings, but service of court notices and orders could be delayed. It specifically included notices of the meeting of creditors, often called a 341 meeting.

Independent reporting matches the central account. Infosecurity Magazine reported on 16 October that a BAE spokesperson described the incident as isolated to the BNC system and said the company was coordinating with the Administrative Office. The publication also noted what officials had not disclosed: the nature of the incident, whether anyone accessed or removed data, and a restoration timetable.

That missing information sets a firm boundary around the story. A cyber incident can mean many things, from suspicious activity that prompts a defensive shutdown to confirmed unauthorised access. The public statements available on 18 October do not identify malware, ransomware, an attacker, a stolen database, or a payment demand. Calling it a data breach would add a fact that officials have not supplied.

The dates also need care. Courts commonly point to 9 October as the beginning of the service disruption, while the national cybersecurity announcement was published on 15 October. One court order reported that effects may have begun earlier, but that does not establish a single confirmed start time for every district and every notice. If a particular deadline or missing notice matters to you, the dates in your own court’s order and case docket carry more weight than a general news summary.

A court has more than one delivery route

The outage makes more sense if you picture a courthouse with a working filing desk and a disabled mailroom. Documents can still arrive at the desk. Judges and clerks can still put entries into a case. Hearings can still remain on the calendar. The separate service that prints, emails, and tracks many court-generated notices can fail at the same time.

The BNC is that large, specialised mailroom. The U.S. Courts description of bankruptcy noticing says it sends notices of bankruptcy cases and court-issued notices to creditors, electronically or by mail. High-volume recipients may be required to use electronic delivery, while other people receive paper or choose an electronic option. Centralising the work saves each court from operating its own national printing and delivery service.

A case docket is the running index of what has been filed and what the court has issued. CM/ECF is the federal courts’ electronic filing and case-management system used by lawyers and other registered participants. PACER is the public route people use to view federal court records. These names often appear together, but they are not interchangeable with the BNC.

That separation explains why some activity continued. The Middle District of Pennsylvania said parties could check the docket for case activity even while service was delayed. Court guidance published during the disruption also said CM/ECF remained operational in its district. A document may therefore appear on a docket before a paper notice reaches a kitchen table or an electronic BNC notice reaches an inbox.

The distinction also prevents an exaggerated conclusion. The BNC outage does not, by itself, prove that PACER or the core case-management systems were compromised. The public judiciary statement names the systems and sites BAE operates for bankruptcy noticing. It does not say that every federal court network, every docket, or every filing was unavailable.

There is another route inside CM/ECF called the Notice of Electronic Filing. Registered users may receive that message when activity is entered, depending on their role and the court’s procedure. A BNC notice, a Notice of Electronic Filing, a paper mailing, and a document served directly by another party can all concern the same case while following different paths. This is why one person may receive something while another person waits.

For a household, the plumbing matters less than the result: no single inbox should be treated as the complete case record during this disruption. A quiet mailbox cannot confirm that the court did nothing. An email that arrives cannot confirm that every affected person received the same information. The docket and the instructions from the court handling the case become the shared reference point.

Why missing notice can change a real person’s week

Bankruptcy notices carry real consequences. They can tell a debtor when to attend a meeting, tell a creditor when a claim must be filed, identify a hearing, report an order, or explain that somebody has asked the court to take a step. A delay may land on people who are already managing debt, a failed business, lost wages, a tenancy dispute, or the collapse of a company that held their money.

Consider a former employee whose employer entered bankruptcy owing a final pay cheque. The employee may be listed as a creditor and may expect a letter explaining the case. If the letter is delayed, they could mistake an empty mailbox for an empty docket. The safe conclusion is much narrower: delivery may be late, so the case needs checking through an official route.

A debtor can face a similar gap. The court may issue a notice about a creditors’ meeting while the BNC cannot send it in the ordinary way. A lawyer who receives electronic docket activity may know, but a person handling the case without a lawyer may be waiting for paper. That person needs the case number, the correct court, and a way to inspect the docket or call the clerk’s office.

Creditors and their lawyers have a second problem. The disruption affected access to mailing matrices and labels used to identify recipients. The District of South Carolina’s 14 October guidance gave CM/ECF users another way to retrieve a list of creditors, then warned that the list did not include every interested party. Debtors, trustees, and the U.S. Trustee might require service even though they were absent from that particular list.

That warning shows why a technical workaround cannot replace the rules. A list that opens successfully can still be incomplete for the job. Somebody responsible for serving a document must work out who legally needs it, use the district’s current procedure, and retain proof of what was sent. For lawyers and represented parties, that is a matter for counsel rather than a home-made address export.

A nationwide service disruption also produces local responses. Bankruptcy courts can issue general or administrative orders dealing with notice and time. Some courts may extend particular deadlines, delay entry of certain notices, authorise another service method, or explain how they will treat documents affected by the outage. Other obligations may continue as before.

This local variation is the reason not to rely on a headline saying “bankruptcy courts are down.” The statement is too broad to guide a real case. The court that holds the case, the judge’s orders, and the docket determine what happened there. Advice from another district may describe a sensible idea, but it cannot change the order governing yours.

The same caution applies to deadlines. A system outage can support relief in some circumstances, and several courts have issued orders. It does not create a safe, automatic extension for every person in every case. Missing a date because a blog post appeared to promise a national pause would turn a communication failure into a personal legal problem.

The cyber incident and the case problem are different problems

Two questions are travelling together here. The first is technical: what happened inside the contractor’s system, what was affected, and when will it be safe to restore? The second is procedural: how do courts and case participants keep notice, hearings, and deadlines fair while a delivery service is unavailable?

The public knows more about the second question. Courts have described delayed electronic and paper notices, unavailable websites, trouble retrieving mailing information, and local workarounds. They have continued to publish orders and instructions. Those are observed effects that a debtor or creditor can act on today.

The technical question remains open. The judiciary and BAE have confirmed a security incident affecting BNC operations. They have not publicly described the point of entry, the attacker’s access, the data held in affected systems, or evidence of removal. An unavailable service can be the result of damage, containment, investigation, or a cautious combination of all three.

This distinction protects people from two unhelpful reactions. One is dismissal: if no breach has been confirmed, perhaps nothing serious happened. The interruption of a national court-noticing service is serious even without a published data theft. Timely notice is part of how people can respond to a legal process.

The other reaction is invention. A person who calls the event a ransomware attack or says bankruptcy records have been dumped online may sound decisive, but the available statements do not support those claims. Speculation makes it harder to see the immediate task, which is keeping up with a case through routes that still work.

BAE’s statement that the incident was isolated to the BNC system is useful but limited. “Isolated” describes the boundary the company reported at that time. It does not answer whether information inside that boundary was viewed, copied, altered, or merely made unavailable. A later investigation may add detail, and any claim about exposure should be updated when that evidence appears.

People whose names appear in bankruptcy matters should already be cautious about unexpected contact. Court files can contain names, company relationships, claim amounts, lawyer details, and procedural events. Much of that information is legitimately public through court records. A convincing scammer does not need a new secret database if a public docket and a newsworthy outage supply enough material for a plausible message.

That point deserves a calm reading. There is no public confirmation on 18 October that this incident gave scammers a list of affected people. The outage can still become a pretext because the event itself is public. Somebody can send a thousand invented “delayed notice” emails and wait for one to reach a person involved in a real case.

A fake notice can contain true case details

Imagine an email with your case number, the debtor’s correct name, and the date of a real filing. It says that the BNC outage blocked an urgent notice, so you must pay a small “reissue fee” or sign in through a replacement portal before midnight. The accurate details lower your guard, while the invented action creates the loss.

Public case information changes the authenticity test. A case number proves that the sender found a case number. A lawyer’s name proves that the sender found a lawyer’s name. Neither detail gives the sender authority to collect a password, a one-time code, a card number, or a payment.

The outage offers a particularly useful excuse for impersonation. A criminal can explain why the message comes from an unfamiliar domain, why the normal website supposedly cannot be used, and why you should act outside the usual process. The lie borrows the exact inconvenience that makes independent checking feel difficult.

Do not solve that problem by memorising every legitimate court address. Domains can be misspelled, display names can be forged, and a compromised account can send a message from a real organisation. Instead, change routes. Find the bankruptcy court from a source you already trust, type the address yourself, use the court’s published telephone number, or ask your lawyer through a known contact.

A real court matter will survive that change of route. The clerk can confirm where public information appears and whether the court posted an outage order. Your lawyer can compare the message with the docket. A scammer usually needs you to remain inside the telephone number, link, attachment, or payment method they supplied.

Attachments deserve the same pause. A PDF can be a genuine order, but an unexpected file may also lead to a fake sign-in page or contain harmful code. There is rarely a reason to use an unsolicited attachment as your only copy when the filed document can be obtained through the official docket or your counsel. Matching the docket entry and document number is stronger than matching a logo.

Bankruptcy also attracts payment fraud that has nothing to do with the BNC. Somebody may promise to erase a case, move you ahead of other creditors, release money, stop a hearing, or collect a debt for a newly appointed agent. The outage does not create a new fee payable by gift card, cryptocurrency, wire transfer to a stranger, or a rushed card form. Verify any genuine cost with counsel or the court’s published information before money moves.

People owed money can be especially vulnerable because an offer may sound like the first progress in months. A message that promises immediate distribution after a small payment turns hope into pressure. Pause at the boundary where the sender asks you to send money, reveal credentials, install software, or keep the conversation secret.

What to do if you are involved in a bankruptcy case

Start with the person who is already responsible for the legal work. If a lawyer represents you in the case, contact that lawyer through the number or address you normally use. Ask whether the outage affects any notice, hearing, filing, service obligation, or deadline in your case. Do not substitute this article for case-specific legal advice.

If you are handling the matter yourself, use a short sequence that creates evidence and reduces guesswork. The goal is to establish the correct court, compare the docket with what you received, and act on the court’s own instructions.

  1. Write down the exact case details. Record the case name, case number, bankruptcy chapter, court district, and the name of the judge if you have it. Copy these from a filing or notice you already trust. “Federal bankruptcy court” is not specific enough because local orders and procedures can differ.

  2. Open the court’s website through your own route. Use the federal judiciary’s main website or a saved address rather than a link in an unexpected message. Look for a notice dated in October 2026 about the Bankruptcy Noticing Center, BNC, service interruption, or cybersecurity incident. Read the page and any linked signed order, because a banner or search snippet may omit the controlling detail.

  3. Check the official docket. The PACER case-search guidance explains how to locate federal court records. If you already have authorised CM/ECF access, use the normal court route. Compare recent docket entries with the notices you received, paying attention to entry dates, hearing dates, document numbers, and who filed each item.

  4. Ask about anything you cannot interpret. Court staff can explain how to access public records and point you to published procedures, although they cannot give legal advice. A legal-aid service or bankruptcy lawyer can explain what an entry means for your rights. If a deadline is close, say so at the beginning rather than waiting for an email exchange.

  5. Keep a simple contact record. Save screenshots or PDFs of the court’s outage notice and relevant docket entries. Note when you called, the published number you used, the name of the office, and what procedural information you received. Keep envelopes and suspicious messages. This record cannot create an extension, but it can show what you knew and what you did.

  6. Meet existing obligations unless the controlling source changes them. Continue following deadlines and service instructions from your lawyer, the docket, and the court’s orders. If an order grants relief, read which dates and documents it covers. Do not stretch a narrow extension into a general pause.

  7. Verify every new request by changing routes. A message that asks for money, a password, a code, or an attachment should be checked against the docket and with a known contact. Begin a fresh call or browser session. Do not use the contact details inside the request you are trying to verify.

This sequence may cost time or a PACER fee, and that is a real inconvenience. If the docket is hard to access or the fee is a concern, call the clerk’s office from the number on the court’s official website and ask what public-access options exist. Courthouse terminals, fee policies, and local assistance vary, so let that court tell you what is available.

Do not repeatedly refresh a failed BNC website and treat the first successful page as proof that all delayed notices have caught up. Restoration can happen in stages, and a website opening does not establish that every old job was sent. The court or BAE needs to confirm the scope of recovery and how queued notices will be handled.

Do not rely on social-media screenshots of an order. A screenshot can lose a page, a signature, a date, or an amendment. Find the same order on the court’s site or docket. If two versions differ, ask which one controls.

Do not telephone every federal bankruptcy court. The case number identifies the district, and that district is the useful starting point. A national switchboard cannot interpret a local order better than the court that issued it.

You also have permission to ignore the technical detective work. You do not need to identify the attacker, search criminal forums, inspect network traffic, or buy identity monitoring merely because a noticing service is offline. None of those activities will tell you whether a hearing in your case moved to Tuesday.

What small businesses and frequent creditors should change

A household involved in one case can check one docket. A small business, landlord, health provider, or supplier may receive notices from many cases and cannot improvise each check. The outage is a prompt to examine how the organisation knows that a notice arrived, where deadlines are recorded, and who notices a gap.

Begin with an inventory rather than a new security product. Identify every route by which bankruptcy information reaches the business: paper mail, a shared email inbox, individual employees, outside counsel, CM/ECF notices, and a BNC electronic account. Write down who checks each route and what happens when that person is away.

Then compare the active cases you know about with the notices received since 9 October. A missing message may indicate the disruption, an old address, an inbox rule, or nothing new at all. The docket and counsel can separate those possibilities. Keep the reconciliation narrow enough to finish, starting with cases that have known hearings, claim dates, payment plans, or pending motions.

A shared mailbox should not depend on one employee recognising every court email. Use a simple case register with the court, case number, responsible person, next known date, and last docket check. Avoid copying sensitive documents into a general spreadsheet when a reference and secure storage link will do. The objective is continuity, not another loose database.

For organisations that send documents, the mailing-matrix problem requires more care. South Carolina’s court guidance shows that a creditor list retrieved through CM/ECF may omit interested parties who still require service. Staff should not assume that exporting the available list completes the job. Counsel or the responsible professional needs to apply the service rules and the current local order.

Proof matters during an outage. Retain the version of the recipient list used, the source and date, the method of service, receipts or tracking where appropriate, and the filed certificate. If the court has authorised an alternative, record the order that authorised it. This is ordinary administrative hygiene with a temporary reason to be stricter.

Business email security also deserves a small adjustment. Tell accounts, reception, legal, and leadership staff that messages may use the BNC incident as a reason for unusual links or payments. Give them one verification route, such as the known outside-counsel number or an internal case owner. A warning without a route leaves people aware but stranded.

Do not create a blanket rule that all bankruptcy email is fake. Genuine CM/ECF activity and direct service may continue, and ignoring it could cause the same harm as trusting a fake. The useful rule is to verify requests that cross a boundary, especially money, credentials, changed bank details, remote access, or a supposed new portal.

What the judiciary and BAE still need to explain

The immediate court notices have done something valuable: they name the affected service, explain that ordinary noticing is disrupted, and point users toward local procedures. Several districts have also distinguished continued filing and docket activity from delayed BNC service. That is the practical information people need first.

A complete public account will need more. The judiciary and BAE should eventually state the confirmed incident window, the affected components, whether unauthorised access occurred, and whether any information was viewed, altered, or removed. If data exposure is found, notices should identify which people and fields were affected rather than using a vague warning for everyone who has ever appeared in a case.

Recovery needs an equally specific account. Users need to know when electronic and paper production resumed, whether notices held during the outage will be sent automatically, how duplicates will be marked, and how courts will handle documents whose useful date has passed. A green website status alone will not answer those questions.

The response should also explain the boundaries among BNC, CM/ECF, PACER, and direct service. People reasonably hear “bankruptcy court cyber incident” and imagine one national machine. Clear diagrams and district instructions can show which channel failed and which source remains authoritative without requiring readers to learn court-system architecture.

Contractor dependence belongs in the review. One provider operates a service used by federal bankruptcy courts nationwide, which brings efficiency and a shared point of failure. Resilience means more than keeping a backup server. Courts need a tested way to identify unsent notices, communicate through another channel, recover a queue without duplication, and give each district enough information to protect due process.

None of that requires naming a villain before the investigation is complete. A useful post-incident report can separate observed facts, likely cause, corrective work, and remaining uncertainty. It can also publish dates for follow-up instead of letting a first announcement become the last one people can find.

Courts face a communication challenge after restoration. Old alerts must be updated visibly so a person arriving from a search result can tell whether the problem remains active. New orders should link back to the earlier ones and say what changed. People should not have to compare timestamps across six pages to work out whether paper notice restarted.

The safest assumption is that the record outranks the inbox

The BNC incident interrupted an important national service. It did not produce one simple rule for every case. Filings and hearings continued in courts that published guidance, notice delivery was delayed, local orders supplied different forms of relief, and the technical cause remained largely undisclosed as of 18 October.

For an affected person, the durable lesson is about authority. A letterbox and an inbox are delivery routes. The court’s docket is the running record, and the court’s signed orders govern the procedure. When delivery becomes unreliable, move closer to those sources rather than trusting a louder message.

That habit also blocks the most plausible follow-on scam. A stranger may know a real case number and describe a real outage. They still do not get your password, code, card, payment, or computer. End the contact, open the court site through your own route, and ask a known lawyer or the clerk’s office what the record says.

Keep the response proportional. Check the case that affects you. Save the relevant order. Ask for legal help when a deadline or right is unclear. You can leave the malware theories, national architecture, and attacker attribution to the investigation.

For one calm, practical security note each month, the newsletter signup is on this site. One email per month, with no manufactured emergency.

Sources