[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAykEmflwbpg3D-tVERa0WXtPNqHzRoHkOopCWcwSJdc":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"7d8e10c6-1051-4c85-b219-475a5e3a3e32","bae-systems-breach-disrupts-federal-court-infrastructure-via-supply-chain-attack","233ed475-7cb1-4050-b00f-39b6a17a4f31","BAE Systems Breach Disrupts Federal Court Infrastructure via Supply Chain Attack","This incident highlights the cascading risks of relying on third-party government contractors for critical public infrastructure. A cyberattack on BAE Systems was able to propagate downstream, halting essential federal bankruptcy court operations — demonstrating that an organization's security posture is only as strong as its weakest vendor link. Federal courts had no apparent ability to maintain continuity of operations independently from their contractor's systems, amplifying the impact. This matters because disruptions to judicial infrastructure can delay legal proceedings, harm citizens awaiting bankruptcy rulings, and undermine public trust in government services.","**Immediate actions:**\n- Activate incident response playbooks specifically designed for third-party\u002Fvendor outages affecting critical operations.\n- Establish emergency communication channels with BAE Systems and demand real-time status updates under contractual SLA obligations.\n- Assess whether manual or backup processes can temporarily restore bankruptcy notice distribution.\n\n**Long-term improvements:**\n- Enforce third-party risk management programs that require contractors to demonstrate SOC 2 Type II or equivalent security certifications.\n- Implement contractual requirements mandating that vendors maintain cyber incident response plans and notify clients within defined timeframes (e.g., 4 hours).\n- Eliminate single points of failure by diversifying critical notice system providers or maintaining an in-house fallback capability.\n\n**Detection & resilience measures:**\n- Deploy continuous monitoring of contractor-provided service health and integrate alerts into a centralized SOC dashboard.\n- Conduct regular tabletop exercises simulating contractor outage scenarios to validate business continuity plans.\n- Require vendors to undergo annual penetration testing and share sanitized results with government clients.",[12,13,14,15,16,17,18,19,20,21],"NIST SP 800-161 (Supply Chain Risk Management)","NIST IR-6 (Incident Reporting)","NIST CP-2 (Contingency Plan)","CIS Control 15 (Service Provider Management)","CIS Control 11 (Data Recovery)","NIST SA-9 (External Information System Services)","ISO 27001 Annex A.15 (Supplier Relationships)","FedRAMP Third-Party Assessment Requirements","FISMA Continuous Monitoring Requirements","NIST SP 800-34 (Contingency Planning Guide for Federal Information Systems)",{},"published","2026-10-16T08:20:29.903512+00:00","2026-10-16T08:20:29.888+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fbae-systems-cyberattack-disrupts-us-federal-court-operations\u002F","bae-systems-cyberattack-disrupts-us-federal-court-operations-d1065e","BAE Systems cyberattack disrupts US federal court operations",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",{"id":44,"name":45,"slug":46,"description":47,"color":48},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[],[51,55,59],{"slug":52,"name":53,"problem":54},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":56,"name":57,"problem":58},"managed-detection-response","Managed detection and response (MDR)","A team watches and responds around the clock when you cannot.",{"slug":60,"name":61,"problem":62},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it."]