A cyber incident at a BAE Systems subsidiary just stopped every bankruptcy court in the US from sending notices, and the problem started a week ago. A security incident at BAE Systems Inc., the US subsidiary of British defense contractor BAE Systems, has taken the Bankruptcy Noticing Center offline since October 9. The Bankruptcy Noticing Center (BNC) is the system that federal bankruptcy courts use to send official notices. It handles court notices, messages to creditors, and deadline notifications that keep everyone involved in a case informed. “BAE Systems IT and websites that support the operations of the Bankruptcy Noticing Center (BNC) have been impacted by a cybersecurity incident.” reads the official judiciary statement. “As a result of the incident, all access to the BNC systems and websites that BAE operates on behalf of the judiciary and the related bankruptcy noticing process are unavailable at this time, including bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service. The incident has also halted the BNC’s production and distribution of bankruptcy notices for bankruptcy courts.” The disruption has prevented the center, which BAE operates on behalf of the federal judiciary, from generating and sending notices to creditors, courts, and attorneys in federal bankruptcy cases across the country. This is not a minor service disruption. The entire notification system used by federal bankruptcy courts across the country is down. “Several online services supporting US federal courts’ bankruptcy systems have gone offline following a cybersecurity incident involving a court contractor, the Administrative Office of the US Courts (AOC) said on Thursday.” Reuters reported. The US judiciary explained that the BNC sends bankruptcy notices for every federal bankruptcy court in the country. Affected domains include bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service. With that last one down, attorneys using the electronic filing system can’t generate the creditor mailing lists they normally need to serve documents. Courts are still accepting new case filings and electronic notifications to registered attorneys are still going out, but anything tied to the noticing pipeline itself has been dark since last Thursday. A BAE Systems spokesperson said that the company is “aware of a security incident that is isolated to the BNC system” and has taken immediate steps to address it. BAE Systems is “coordinating closely” with the courts on the response, the spokesperson said. Neither BAE nor the judiciary disclosed tachnical details of the incident, whether it was a deliberate cyber attack or a different kind of incident, or whether any data was accessed or taken. The Eastern District of Texas bankruptcy court’s own public notice adds a useful detail: BAE first told the Administrative Office about the problem late on October 9, which means the court system’s administrative leadership knew by that evening. “Late on Friday, October 9, 2026, BAE Systems, the contractor that services the Bankruptcy Noticing Center (BNC), notified the Administrative Office of a service disruption impacting BAE systems that process notices as well as the following websites: bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service website that supports CM/ECF access to address labels (the mailing matrix).” reads the notice. “Because of this disruption, the court polling and certification drop-off process that supports the delivery of electronic and paper notices has been interrupted and the BNC is unable to provide noticing services to the courts at this time.” Courts started posting disruption notices on October 13, but none of them mentioned a cybersecurity incident at that point, several framed it as a service interruption. The public acknowledgment of the word “cybersecurity” didn’t come until October 15. Summarizing, the incident started on or before October 9. The judiciary’s administrative office learned about it that day. Courts informed users of the problem on October 13, and the public announcement confirming a cybersecurity incident came on October 15. That’s six days between the contractor discovering the problem and the public announcement. During that time, bankruptcy cases across the country continued without the system that sends notices to keep courts, creditors, and lawyers informed. No one has announced when the service might be restored, suggesting the investigation is still at an early stage. This incident highlights a recurring problem: critical systems operated by contractors can fail in a single incident, disrupting services across every federal court handling a specific type of case. The public also waited nearly a week for an official statement. This is not a new pattern, but it keeps happening. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, BAE Systems)
Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishing The post Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026 appeared first on Unit 42.
Burger King Japan, the Japanese subsidiary of global fast-food giant Burger King, disclosed a major data breach after attackers accessed a server containing 11.18 million customer records. Founded in 1953 in Florida, Burger King is now a multinational fast-food chain with nearly 20,000 locations worldwide, including 350 in Japan. In a Thursday press release, Burger King Japan said it concluded a follow-up investigation on October 13 and apologized to customers whose data was stolen in early October and leaked online. The breached servers stored the personal information for users of the company's official smartphone app, including their names, dates of birth, gender, email addresses, phone numbers, and order history. "We identified a potential unauthorized third-party access to the system that manages member information for our official app and conducted an investigation," Burger King Japan said.
The regulated utility company CenterPoint Energy says a data breach exposed the personal information of more than 1 million people in Texas. CenterPoint Energy is a regulated utility company used to deliver natural gas and electricity infrastructure, maintain power grids and pipelines, and restore service across parts of Texas, Indiana, Ohio, and Minnesota. The organization disclosed a data breach affecting more than 1 million people in Texas. This week, CenterPoint Energy told the Texas Attorney General’s Office that the breach affected 1,062,060 Texas residents. The company does not appear to have notified the affected individuals by letter. “More than one million Texans were affected by a CenterPoint Energy data breach that compromised sensitive personal information, according to newly published information from the Texas Attorney General’s Office.” reported the broadcast Click2Huston. “The state’s data breach database lists 1,062,060 Texans as being affected. The information involved includes customers’ names, addresses, Social Security information and driver’s-license numbers.” Days before the first disclosure, on September 12, a threat actor using the alias “4d722e4d656f77” claimed on a cybercrime forum to have extracted roughly 7.49 million customer records from CenterPoint Energy. “In September 2026, CenterPoint Energy, Inc. (the “Company”) became aware of an online post by a third party claiming to have obtained a data set containing certain of the Company’s customer information.” reads the FORM 8-K report filed with SEC.”While the investigation remains ongoing, the Company has determined that an unauthorized third party obtained personal information relating to a portion of the Company’s customers through one of the Company’s external facing systems (the “Incident”).” The hacker claimed the theft of names, phone numbers, service and billing addresses, account numbers, billing amounts, payment status, and partial Social Security numbers. He offered a 2.5 GB archive for download. The attacker warned that “next time we won’t simply pull data, we’ll start attacking the main infrastructure,” a line that reads well on a forum but should still be taken seriously by any critical infrastructure operator. The attackers claimed they stole over the records through an API they say lacked proper WAF protection, rate limiting, and authentication. They also claimed the company tried to stop the data dump only after millions of records had been extracted. “CenterPoint Energy continues to actively investigate the cybersecurity incident disclosed last month. Upon learning of the issue, CenterPoint activated our incident response procedures and engaged external cybersecurity, forensic, and legal advisors to assist with the investigation.” a spokesperson for CenterPoint said on Wednesday. “We continue to work with third-party experts to assess the scope of affected customer data to identify which customers will be provided notifications in accordance with applicable legal requirements.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, data breach)
In the space of a month, a new category of AI model went from nonexistent to everywhere. TypeSafe AI released Jev on September 15 and called it a System One model, a nod to Kahneman's fast, intuitive thinking. OpenAI announced its own Decisions API at DevDay and opened a public beta on October 6. Cribl published cribl-decision, an open LoRA adapter you can run locally. Others, like Laya, are
Google announced new AI-powered defenses against scam messages and call-forwarding abuse on Android, currently rolling out to eligible devices. The new measures aim to address the increased sophistication of scams targeting mobile users, including fraudulent bank alerts and voice-cloning attacks. “Mobile scams have evolved far beyond basic robocalls and phishing texts, turning into sophisticated operations that use spoofed numbers, fake bank alerts, and AI voice cloning,” Google says. “With scams growing harder to spot, it’s nearly impossible for users to catch every red flag themselves,” added the tech giant. Google says its existing Phone and Messages scam detection flags more than 5 million suspected scam calls and texts monthly, but the new measures are expected to catch even more threats.
Microsoft announced that Windows Server 2022 has reached the end of mainstream support and will remain in extended support until October 2031. Microsoft unveiled Windows Server 2022 in March 2021 and made it generally available in September 2021 as a Long-Term Servicing Channel (LTSC) release with 10 years of support. "As of October 13, 2026, Windows Server 2022 has reached end of mainstream support and transitioned to extended support. The October 2026 security update is the last mainstream support update available for this version," it said. "Extended support includes security updates at no additional cost, and Windows Server 2022 will continue to receive monthly security updates through October 14, 2031." Microsoft has also extended Windows Server 2022 hotpatching until October 2027, one year after the mainstream end date of October 2026, for systems running the Datacenter: Azure Edition.
The Indian government has directed telecom service providers (TSPs) in the country to mandatorily display callers' registered names along with their numbers for incoming calls starting November 1, 2026, in an effort to help people identify calls from unknown numbers and tackle spam or fraudulent calls. To that end, the Department of Telecommunications has issued a circular urging service
Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. "Since January 2026, the threat actors behind these kits have been responsible for
A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks.
Confirm this action.
Leaving now will discard your changes.