[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIQrJi73h0MwiESvwyWtI0Mp-_BssiimYrgbKDUlWr3U":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":44,"controls":45},"029036b7-0ec2-4414-8ede-85e7bff55511","bae-systems-breach-cripples-us-bankruptcy-court-noticing-system","cf74ae13-5521-46c4-be98-c54644be904e","BAE Systems Breach Cripples US Bankruptcy Court Noticing System","A cyberattack on BAE Systems, a third-party defense contractor operating the Bankruptcy Noticing Center (BNC), cascaded directly into critical U.S. federal court operations — halting the production and delivery of legally required bankruptcy notices nationwide. This incident exemplifies the systemic risk of outsourcing critical government functions to a single vendor without adequate resilience planning. The lack of an estimated restoration timeline and the absence of disclosed root cause suggest gaps in both incident response preparedness and communication protocols. When a third-party supplier is compromised, the downstream impact can be far broader and harder to control than an internal breach, making supplier risk management a national security concern.","**Immediate actions:**\n- Activate business continuity and manual fallback procedures to resume critical court notifications during the outage.\n- Require BAE Systems to provide a formal incident report including scope, root cause, and a binding remediation timeline.\n- Conduct an emergency access review to identify and revoke any potentially compromised credentials linked to BNC systems.\n\n**Long-term improvements:**\n- Mandate contractual SLAs and security standards (e.g., FedRAMP, NIST 800-171) for all vendors operating critical government infrastructure.\n- Eliminate single points of failure by requiring vendors to maintain geographically redundant, independently operable backup systems.\n- Implement a formal Third-Party Risk Management (TPRM) program with annual security audits and penetration testing for high-criticality suppliers.\n\n**Detection & resilience measures:**\n- Deploy continuous monitoring and alerting on all vendor-operated systems that interface with federal judicial infrastructure.\n- Establish pre-negotiated incident response playbooks with critical vendors, including defined escalation paths and communication cadences.\n- Require vendors to maintain tested disaster recovery plans with documented Recovery Time Objectives (RTOs) for mission-critical services.",[12,13,14,15,16,17,18,19,20,21,22],"NIST SP 800-161 (Supply Chain Risk Management)","NIST SP 800-34 (Contingency Planning)","NIST IR-6 (Incident Reporting)","CIS Control 15 (Service Provider Management)","CIS Control 17 (Incident Response Management)","NIST AC-2 (Account Management)","NIST CP-2 (Contingency Plan)","NIST SA-9 (External Information System Services)","ITIL Service Continuity Management","FedRAMP Authorization Requirements","FAR 52.239-1 (Privacy or Security Safeguards)",{},"published","2026-10-16T16:20:16.514135+00:00","2026-10-16T16:20:16.497+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fcyberscoop.com\u002Fbae-systems-cybersecurity-incident-us-bankruptcy-courts\u002F","cybersecurity-incident-at-bae-systems-disrupts-us-bankruptcy-court-system-d8260f","Cybersecurity incident at BAE Systems disrupts US bankruptcy court system",[32,38],{"id":33,"name":34,"slug":35,"description":36,"color":37},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":39,"name":40,"slug":41,"description":42,"color":43},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[46,50,54],{"slug":47,"name":48,"problem":49},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",{"slug":51,"name":52,"problem":53},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",{"slug":55,"name":56,"problem":57},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it."]