A Cyberattack Has Left Bankruptcy Courts Reassigning Their Own Legal Notices

A cybersecurity incident has disrupted the federal Bankruptcy Noticing Center, forcing courts nationwide to establish temporary procedures for delivering legally required notices.

On October 16, the U.S. Bankruptcy Court for the Southern District of Florida issued an emergency administrative order changing who must deliver official notices in bankruptcy cases. For cases filed on or after October 7, the debtor's attorney, or the debtor personally if unrepresented, must mail the notice announcing the case and the required meeting of creditors. The order gives them three days after the later of its issuance or the court's production of the notice. It also assigns additional mailing responsibilities when cases are discharged, dismissed or closed, and requires affected parties to document that service was completed.

These are ordinarily functions supported by the federal judiciary's Bankruptcy Noticing Center, a centralized system responsible for producing and distributing notices across the country's bankruptcy courts. Since October 9, that system has been unavailable following a cybersecurity incident affecting its contractor, BAE Systems. The Administrative Office of the U.S. Courts publicly confirmed the disruption on October 15, explaining that the incident had stopped the center's production and distribution of notices nationwide. Several associated websites and the National Creditor Registration Service were also unavailable.

Bankruptcy courts have continued accepting filings, opening cases and processing documents. Their primary electronic case-management system remains operational, and registered users can still receive certain electronic filing notifications. But those systems don't replace every notice that must reach a debtor, creditor or other interested party. In particular, people who aren't registered for electronic court notifications may depend on the service that has stopped functioning.

Florida's order illustrates what happens when a centralized administrative function becomes unavailable while the legal obligations it supports remain in force. Hearings and statutory deadlines generally continue unless the court orders otherwise. Parties who believe they were harmed by delayed notice can request relief, but they may need to file a motion identifying the affected notice, explaining the consequences and specifying what remedy they need. Unrepresented parties who cannot comply with the temporary procedures are instructed to contact the clerk or seek relief from the court. Filing that request doesn't automatically extend a deadline.

The court has established protections intended to prevent people from suffering adverse consequences because legally required notice wasn't delivered. It has also preserved judicial discretion to assign notice responsibilities differently in individual cases. Those safeguards matter. They show that the judiciary has retained the authority and some of the practical capacity to respond to the disruption.

But the response also reveals how much administrative work was concentrated in the system that failed. Responsibilities previously handled through a national service are being redistributed among individual courts, attorneys, trustees and debtors. People who entered bankruptcy because they couldn't meet their financial obligations may now have additional procedural work to complete simply because the institution's contracted notice system is unavailable. The order doesn't establish that anyone has lost a legal right. It establishes that protecting those rights now requires different procedures, additional effort and, in some cases, an individual request for relief.

The distinction between a court remaining open and its procedures remaining accessible is central to this development. A functioning docket doesn't guarantee that everyone entitled to participate has received the information necessary to do so. Nor does the existence of a legal remedy guarantee that the person who needs it knows the remedy is available.

That makes the outage more consequential than an ordinary interruption of a government website. It has affected a process through which legal obligations are communicated, deadlines become meaningful and affected people are given an opportunity to respond.

Courts Are Using Different Procedures to Replace the Same National Service

The Bankruptcy Noticing Center was designed to perform a shared function for federal bankruptcy courts. Centralization allows courts to rely on common infrastructure for a large volume of routine communications, including paper and electronic notices. It can reduce administrative duplication and provide consistent processes across districts. But the October incident demonstrates what happens when a service used nationally loses its ability to operate.

The Eastern District of Texas reported that the disruption began late on October 9. By October 14, it had issued two general orders addressing deadlines and relief associated with the outage. The court continued accepting filings and processing cases, but warned that notices and orders might be delayed. It also published instructions for obtaining creditor names and addresses through the case-management system because the normal mailing-matrix function was affected.

That workaround has limitations. The court cautioned that the available creditor list doesn't necessarily include everyone entitled to notice, including debtors, trustees and certain government parties. Attorneys and other users must therefore determine whether additional recipients need to be identified. The technical ability to retrieve a list of creditors is useful, but it doesn't fully replace the administrative process that previously assembled and distributed legally sufficient notices.

The District of Hawaii issued similar guidance. It confirmed that ordinary electronic filing notifications remained operational while notices generated through the Bankruptcy Noticing Center were interrupted. Its instructions directed people without access to the electronic case-management system to contact the court's help desk. The court also advised that people prejudiced by missing or delayed notices could request relief. At the time of its October 14 announcement, it had no estimated restoration date.

These responses demonstrate meaningful compensatory capacity. The judiciary hasn't simply waited for its contractor to restore service. Courts have identified affected functions, published alternative procedures and exercised their authority to address deadlines and notice requirements. The electronic filing infrastructure also provides a functioning channel for some users, limiting the scope of the disruption.

The difficulty is that the substitute procedures aren't equivalent to the original service. A national system ordinarily performs notice-related work without requiring each affected person to determine which parts of the process have failed. Under the temporary arrangements, responsibility is more dispersed. Individual courts must decide how to handle the interruption, legal professionals must verify service requirements, and some unrepresented parties must perform tasks that would otherwise have been handled for them.

There is also a difference between making relief legally available and making it practically accessible. Someone represented by an attorney may have help identifying a missing notice, understanding its significance and requesting an extension. Someone without representation may first have to discover that a notice was delayed, determine which deadline was affected and understand how to bring the problem before a judge.

The Florida order recognizes this problem by allowing unrepresented parties to seek procedural assistance and by authorizing the court to establish alternatives where necessary. It also specifies that a motion for relief doesn't automatically stop an approaching deadline. The system therefore remains capable of correcting individual problems, but some of the work required to obtain that correction has shifted toward the people affected.

The outage's ultimate consequences aren't yet established. There is no verified national count of notices delayed, parties prejudiced, hearings continued or additional costs imposed. Nor has the judiciary publicly established that the incident compromised case records or personal information. The contractor has described the incident as isolated to the Bankruptcy Noticing Center system, while the investigation and restoration work continue.

Those unknowns limit what can responsibly be concluded about the damage already done. They don't prevent an assessment of the structural change documented in the court orders. A nationally shared administrative service stopped performing a legally consequential function, and courts have had to reconstruct that function through local procedures while continuing their ordinary operations.

The central question is how effectively those procedures preserve access for people who depend on the missing service, particularly if restoration takes longer than anticipated.

A London Cloud Outage Interrupted Banking and Court Hearings

On October 20, a separate disruption affected digital services across the United Kingdom and parts of Europe. Google reported that a power-related incident had caused an outage in one of the availability zones within its London cloud region, known as europe-west2. Multiple cloud products experienced service interruptions, elevated error rates or intermittent network failures.

The consequences appeared across organizations that provide very different services. Revolut reported problems affecting card payments, transfers, cash withdrawals and account access. Customers of several other banks experienced difficulties using online services. Britain's courts and tribunals service also encountered problems with its Cloud Video Platform, which is used to connect participants to court proceedings remotely.

The disruption affected legal hearings as well as financial transactions. Reporting from the United Kingdom described difficulties involving remote court attendance, including proceedings that depend on video links for participants who aren't physically present. By early afternoon London time, Google was reporting recovery across most affected workloads, and court video services were beginning to return. Google said the underlying power event had been mitigated and suggested that customers could attempt to move affected workloads to another available zone or region where feasible.

This incident was not caused by the cyberattack affecting U.S. bankruptcy notices. The two events involved different providers, infrastructure and failure mechanisms. There is no evidence connecting them operationally.

Their significance lies in the functions they interrupted. In the United States, a cybersecurity incident at a government contractor stopped a centralized system for communicating legal notices. In Britain, a cloud infrastructure failure temporarily interrupted technology used to participate in court proceedings. The same cloud incident also affected banking services, demonstrating how infrastructure operated by one provider can support organizations whose public responsibilities and commercial activities are otherwise unrelated.

The cloud outage also provides evidence of recovery capacity. Google identified the affected region, reported the power-related failure and began restoring services within hours. Some customers had options to move workloads to another location. Financial institutions communicated with customers, and at least some affected services resumed during the day. These responses distinguish a serious but temporary service interruption from a prolonged loss of the underlying institutions' ability to operate.

Still, moving an application to another region isn't necessarily a practical option for every customer. It depends on how the service was designed, whether its data and dependencies can be transferred, and whether alternative infrastructure is already available. The existence of multiple availability zones doesn't mean every application can automatically survive the loss of one. A service may rely on a particular database, network configuration or supporting component that wasn't designed to fail over immediately.

This is especially important for public institutions and regulated services because their responsibilities continue during a technology failure. A court must still provide lawful proceedings. A financial institution must still account for customer funds and transactions. Restoring the technical system is essential, but organizations may also have to reconcile delayed transactions, reschedule proceedings or verify that records remained complete and accurate.

British financial regulators had already identified the significance of these dependencies. In July, the United Kingdom designated several technology providers, including Google Cloud's European business, as critical third-party suppliers to financial institutions. That designation brought them under direct regulatory oversight intended to address the risks associated with concentrating important financial services in external technology infrastructure. European Union regulators have established related oversight arrangements for critical information and communications technology providers.

The October outage doesn't establish that those regulatory arrangements failed. Their purpose includes identifying and managing risks that cannot necessarily be eliminated. What the incident provides is a concrete test of the relationship between external technology providers and institutions that remain responsible for delivering essential services. The relevant questions now include whether affected organizations had workable continuity plans, how quickly they restored operations, and whether regulators can obtain enough information to evaluate the incident and require improvements where necessary.

Grocery Stores Stayed Open While Their Digital Services Were Disabled

A third development provides a useful comparison because its compensatory arrangements operated differently.

On October 19, international grocery retailer Ahold Delhaize confirmed that malicious activity had prompted it to take parts of its information technology infrastructure offline. The company operates grocery brands in Europe and the United States, including Albert Heijn, Stop & Shop, Giant Food, Hannaford and Food Lion. Its decision to disconnect systems affected websites, applications and other services across most of its brands, although the consequences differed by business.

The incident began around October 11 and was disclosed publicly on October 12. By October 19, some services had been restored, but Albert Heijn's home deliveries in the Netherlands were not expected to resume until October 23. E-commerce services at the company's American brands were also still being restored. Belgian e-commerce operations had returned, along with many websites and applications elsewhere in Europe.

The company reported that its physical grocery stores remained open throughout the incident. It also said that its investigation had not identified evidence that sensitive customer, employee or partner information had been taken, while emphasizing that the investigation was continuing. The identity of the attackers and the precise method used had not been publicly established.

The stores' continued operation is consequential. Customers retained an alternative way to purchase food even when online ordering and delivery services were unavailable. Employees and distribution operations were also able to maintain at least some functions while digital systems were restored. The company's response demonstrates that shutting down compromised technology can preserve other parts of a business, even when the protective action itself causes significant disruption.

But physical stores aren't an interchangeable substitute for every customer. Home delivery may be essential for people who cannot easily travel, lack transportation, have disabilities or depend on scheduled deliveries. The same outage can therefore be a manageable inconvenience for one household and a serious access problem for another. The existence of a functioning alternative tells us something about the organization's resilience, but not necessarily whether that alternative is accessible to everyone who relied on the original service.

The grocery incident also illustrates the operational reach of shared corporate infrastructure. Ahold Delhaize operates distinct brands in different countries, but a security problem affecting shared systems required protective measures across much of the group. That is evidence of an internal dependency capable of transmitting disruption across geographic and organizational boundaries. It doesn't establish that every affected brand used identical systems or that all services were disabled for the same technical reason.

These three incidents shouldn't be combined into a single cybersecurity event. The U.S. bankruptcy disruption involves a contracted court-notification service. The London cloud outage resulted from a reported power event. The grocery disruption followed malicious activity in a corporate network. Their immediate causes, recovery processes and consequences differ.

What makes them analytically related is the location of the work that must continue when the technology becomes unavailable. In each case, organizations had to preserve functions that depended on infrastructure outside the immediate control of the people using those functions. The alternatives ranged from manually delivering court notices to moving cloud workloads or keeping physical stores operational.

Those alternatives have different limits. Some require additional labor. Some require technical preparation before the incident occurs. Others depend on whether customers or affected parties can use a different service channel. The availability of a substitute is therefore only one part of the assessment. Its capacity, accessibility and cost determine how much of the original function it can actually preserve.

Federal Agencies Still Don't Have Complete Inventories of Connected Devices

The latest incidents occurred against a broader record of incomplete technology oversight.

On September 30, the Government Accountability Office released a report examining how federal civilian agencies identify and manage networked devices. These include internet-connected equipment and operational technologies used in buildings, laboratories and other government facilities. Federal requirements call for agencies to maintain inventories containing information necessary to understand and secure those devices.

Of the 22 agencies reviewed, 15 had established an inventory as of September 2026. Eleven were maintaining their inventories, and ten had included all required information for each device. Only seven had fully met all three requirements. GAO also found that the Office of Management and Budget had not issued updated guidance covering fiscal year 2026 or provided the oversight needed to ensure agencies completed the work.

This finding doesn't explain the Bankruptcy Noticing Center incident, the London outage or the grocery cyberattack. GAO examined a different set of federal technology-management responsibilities, and the report doesn't establish that any of those incidents resulted from missing device inventories.

Its relevance is to the capacity to identify and manage technological dependencies before they fail. An organization cannot reliably assess the security of equipment it hasn't identified. Incomplete inventories can leave agencies uncertain about which devices are connected, what software they use, which security controls apply and whether known vulnerabilities have been addressed. The GAO findings document an institutional weakness in maintaining that information, even though the relevant requirements have existed for years.

Another development this week raises the importance of those unresolved responsibilities. On October 19, Reuters reported on a cybersecurity investigation documenting the use of autonomous AI agents to attempt intrusions against more than 1,200 websites across several countries. Researchers reported more than 100 successful compromises, while Reuters independently examined activity records and contacted affected companies. Some businesses confirmed limited intrusions or remediation, although the extent of any data theft remained uncertain.

The investigation suggests that automated tools can reduce the labor required to search for vulnerabilities across large numbers of targets. It doesn't establish that the same tools were involved in any of this month's major service disruptions. The relevance is prospective: organizations with incomplete inventories, poorly secured secondary systems or insufficient monitoring may face a growing volume of attempts to exploit those weaknesses. The number of attempted intrusions could increase without a corresponding increase in the number of human attackers conducting them.

That changes the demands placed on defensive systems. Preventing incidents requires knowing which systems exist, how they connect and what access they provide. Responding to incidents requires isolating affected components without unnecessarily disabling essential functions. Recovering requires alternative procedures, accurate records and enough personnel to restore services while meeting continuing obligations.

The federal bankruptcy response shows that some of those capabilities remain available even after a shared service stops operating. Courts have preserved case processing, identified substitute procedures and established ways to seek relief. The British cloud outage shows that substantial technical recovery can occur within hours. Ahold Delhaize's decision to disconnect affected systems preserved physical retail operations while digital services were restored.

These are meaningful successes. They also demonstrate that resilience isn't captured by whether a system is described as operational. A court can remain open while notice delivery is interrupted. A bank can safeguard deposits while customers cannot complete transactions. A grocery chain can keep stores open while its delivery network is unavailable. Each organization may be functioning in an important sense while particular obligations or services remain difficult to fulfill.

The structural concern becomes more significant when those interruptions require the people least equipped to manage them to perform additional work. Bankruptcy debtors may need to send official notices. Customers may have to find another way to purchase groceries. People participating in remote hearings may have to wait for proceedings to resume. These consequences vary in severity, and the available evidence doesn't establish widespread irreversible harm. But they show where the cost of preserving institutional function can move when centralized systems fail.

This is the point at which the Risk Monitor needs to distinguish technical restoration from institutional repair. Restoring the Bankruptcy Noticing Center would allow ordinary notice production to resume. It wouldn't automatically establish whether every delayed notice had been delivered, every affected deadline had been addressed or every person entitled to relief had received it. Similarly, restoring cloud services doesn't by itself establish that all delayed transactions and proceedings have been reconciled.

The institutions remain responsible for those outcomes even when their contractors operate the systems through which the work is performed. Whether they can identify every affected obligation, correct the consequences and demonstrate that correction is the more consequential measure of recovery.

What I’m watching now

The immediate question is when the Bankruptcy Noticing Center resumes operations and how the federal judiciary handles notices accumulated during the interruption. A restoration announcement would establish that the contractor has recovered the service, but it would not establish that the notice backlog has been cleared. I want to see whether the Administrative Office publishes the duration and scope of the outage, how many notices were delayed, and whether courts identify cases requiring corrective service. The handling of deadlines, continuances and requests for relief will show whether temporary procedures protected affected parties or left problems to be resolved individually.

The differences among district responses also deserve attention. Florida has issued a detailed order reallocating service responsibilities. Texas and Hawaii have published their own procedures and protections. A useful next step would be to determine whether the judiciary develops a more uniform national response or continues relying primarily on district-level arrangements. Neither approach is automatically inadequate. The relevant measure is whether legally required notices reach the appropriate people and whether those affected by failures can obtain timely correction without unreasonable additional burdens.

For the London cloud outage, the strongest evidence of recovery will come from Google's final incident report and the responses of affected institutions. Restoration times, the specific infrastructure that failed, the effectiveness of failover arrangements and any remaining service backlogs will help establish whether the incident exposed weaknesses that require further intervention. Regulatory findings would be particularly important because financial authorities have already identified critical cloud providers as a subject of direct oversight. Evidence that institutions successfully maintained or restored essential operations through tested continuity plans would weaken the assessment of inadequate redundancy.

Ahold Delhaize's restoration schedule provides a more immediate operational measure. The return of home deliveries, online ordering and distribution services would demonstrate that the company can restore affected functions without compromising its remaining operations. Continued outages, additional disruptions or evidence of more extensive compromise would strengthen concern about the consequences of shared digital infrastructure. The company's final investigation may also clarify whether its protective shutdown prevented wider damage.

The GAO findings raise a longer-term question about institutional correction. OMB can issue updated guidance, and agencies can complete and maintain the required inventories. Those would be measurable improvements. The important evidence will be whether agencies actually meet the requirements and whether oversight verifies that the inventories are accurate and useful. A policy announcement without implementation would leave the underlying weakness largely unchanged.

I'm also watching whether the growing use of autonomous tools in cyber intrusions produces verified changes in incident frequency, detection times or defensive capacity. The October 19 investigation provides evidence of one significant campaign, but it doesn't establish how widespread the technique has become or how effectively organizations are adapting. Additional independently verified incidents, especially those affecting essential services, would alter that assessment.

Across these developments, the most important indicators concern the work that remains after a system is technically restored. If institutions can account for interrupted services, identify everyone affected and complete necessary corrections, the evidence would support substantial repair capacity. If systems return online while unresolved obligations, inaccessible remedies or incomplete records remain, the assessment would need to distinguish operational recovery from the restoration of the service people were entitled to receive.

Current Risk Assessment · October 20, 2026

Current assessment: Strained, with substantial compensatory capacity still functioning. A cybersecurity incident has interrupted the nationwide system used to distribute federal bankruptcy notices, requiring courts to establish temporary procedures for legally consequential communications. Separate cloud and corporate cybersecurity incidents have disrupted banking, court participation and grocery services. Recovery mechanisms are operating, but their effectiveness varies by service, institution and the ability of affected people to use available alternatives.

Expected if this assessment holds: Continued reliance on temporary administrative procedures while the Bankruptcy Noticing Center is restored, followed by additional work to reconcile delayed notices and affected proceedings. Organizations dependent on shared digital infrastructure may experience further service interruptions requiring manual workarounds, technical failover or temporary suspension of affected systems. The consequences are likely to be uneven, with greater burdens on people and institutions that lack accessible alternatives.

Would weaken the assessment: Prompt restoration of the Bankruptcy Noticing Center accompanied by verified clearance of delayed notices, consistent protection of affected parties and limited unresolved procedural consequences; evidence that cloud and grocery services have recovered without significant outstanding obligations; effective continuity arrangements demonstrated through incident reviews; and measurable progress in federal technology inventories and oversight.

Status: STRAINED — COMPENSATING. The documented incidents have interrupted essential functions without establishing a general failure of the institutions responsible for them. Courts, technology providers and businesses have preserved or restored substantial operations. The unresolved risk concerns whether their compensatory arrangements can reliably deliver the original services, particularly where legal rights, financial access or essential household needs depend on functions that remain interrupted.

Sources

Administrative Office of the U.S. Courts, “Cybersecurity Incident Disrupting Bankruptcy Court Operations”, October 15, 2026. Primary confirmation of the contractor incident and nationwide interruption of Bankruptcy Noticing Center services.

U.S. Bankruptcy Court, Southern District of Florida, “Administrative Order 2026-06: Bankruptcy Noticing Center Service Interruption”, October 16, 2026. Primary court order establishing temporary notice responsibilities, deadlines, safeguards and procedures for relief.

U.S. Bankruptcy Court, Eastern District of Texas, “BNC Service Interruption Update”, October 14, 2026. Court announcement documenting emergency orders, continued case processing and alternative creditor-list procedures.

U.S. Bankruptcy Court, District of Hawaii, “Notice of BNC Nationwide Outage”, October 14, 2026. Primary description of affected notice services, functioning electronic filing notifications and available procedural remedies.

Reuters, “U.S. Federal Bankruptcy Court Operations Disrupted by Cybersecurity Incident”, October 16, 2026. Independent reporting on the contractor incident and its effects on federal court operations.

Google Cloud Service Health, “Multiple Services Are Experiencing Issues in the europe-west2 Region”, October 20, 2026. Primary incident record identifying the affected infrastructure, reported power event, service interruptions and recovery updates.

Reuters, “Google Cloud Services Down in UK; Banks, Public Sector Report Issues”, October 20, 2026. Reporting on the cloud outage, affected financial services and regulatory oversight of critical technology providers.

The Guardian, “Google Cloud Failure Hits Millions as UK Courts and Banks Knocked Offline”, October 20, 2026. Reporting on disrupted remote court hearings, banking services and the initial recovery.

Ahold Delhaize, “Ahold Delhaize Update on Status of Cybersecurity Incident”, October 19, 2026. Primary company statement documenting the incident, protective shutdowns, continued store operations and restoration schedule.

U.S. Government Accountability Office, “Internet of Things: OMB Action Needed to Ensure Agencies Secure Their Networked Devices,” GAO-26-108937, September 30, 2026. Primary audit of federal agency networked-device inventories and oversight deficiencies.

Reuters, “How One Hacker Used AI Agents and a Few Thousand Dollars to Break Into Scores of Sites”, October 19, 2026. Investigation documenting autonomous AI-assisted intrusions, affected businesses and remaining uncertainties about the extent of compromise.