Restoration closes a service outage, not the evidence work. The Bankruptcy Noticing Center came back online after a nationwide disruption, and the judiciary reported that BAE Systems had resolved the issues. The public record still leaves important questions open. A useful incident record should preserve both the recovery facts and the limits of what was disclosed.

That record has operational value beyond the immediate event. It gives courts a basis for reviewing delayed notices, supports future contractor oversight, and prevents a later analyst from rebuilding the timeline from memory. It also creates a clean line between what an external inventory observed and what the operator confirmed.

Capture the official timeline

The Administrative Office of the U.S. Courts said a cybersecurity incident affected BAE Systems IT and the websites supporting the BNC. The Eastern District of Texas reported that BAE notified the Administrative Office late on October 9 about the disruption. Courts published continuity notices while filings and other case work continued.

The judiciary later reported restoration and said the Judicial Conference had declared a Bankruptcy Rules emergency on October 22. The declaration gave bankruptcy judges authority to address deadlines affected by the outage. A restoration notice from the Northern District of Alabama, dated October 27, said the BNC was back online and that notices generated during the disruption would be processed and sent.

The record should include each statement's date, source, and later update. The October 15 page is especially important because its October 27 update changes the status from ongoing disruption to restored service. An analyst must not quote the earlier state as current.

Record the service boundary

List the named public properties: bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service. Add the responsible operator and the court processes that depend on it. Distinguish those services from the wider uscourts.gov namespace and from unrelated court applications.

Attach the exact external queries used for verification. The parent-domain query returned 1,822 observations in the November 2 collection. The three named BNC domains returned one. A country filter for the United States returned 1,780 parent-domain observations. Keep the role of each query next to the count.

The record should state that the parent-domain results include services beyond the BNC. It should also state that a domain observation does not establish compromise, data access, or the attack path. These statements prevent a later reader from treating a public inventory as a forensic conclusion.

Preserve the unresolved questions

The public record does not name the intrusion vector, the affected application, the attacker, or any data-access finding. Those questions should be listed as unknown, not as negative facts. "No data access was disclosed" is supportable. "No data was accessed" is not supported by the public sources.

The same care applies to the recovery. The operator reported that the issues were resolved. The record does not disclose which controls changed, whether credentials were rotated, or whether a replacement component was introduced. Those details may exist in private logs, but they should not be invented in a public analysis.

Make the record actionable

After restoration, the institution should reconcile the service register with what was learned. Confirm that the named endpoints point to the intended service, that certificates and DNS records are accurate, and that old integrations have an explicit disposition. Review whether courts completed the backlog and whether temporary procedural changes were closed.

The contractor review should examine the evidence trail: notification time, investigation updates, restoration criteria, and the completeness of the affected-service list. It should also check whether the public status message matched the operational state. A restoration statement is a starting point for validation, not proof that every dependent workflow has recovered.

Keep an external evidence appendix

Store the ZoomEye queries, collection times, and result counts in an appendix. Use the same format for the narrow and broad scopes. Include the query for recent changes and the zero results if they informed the review. Record that a zero is limited to the selected filter and collection window.

The appendix should link to the public sources that anchor the incident facts and to the product search URL that makes the observation reproducible. It should not contain credentials, internal asset records, or claims about affected users that the public sources do not support.

A durable outcome

The BNC outage created a visible service failure, a nationwide workflow disruption, and a difficult recovery. The durable response is a record that can be audited: confirmed timeline, known service boundary, external public observations, unresolved technical questions, and completed recovery checks.

ZoomEye supports the external part of that record by turning a broad court-domain search into a reproducible observation with a clear scope. It cannot substitute for the judiciary's or BAE's internal evidence. The best use of the tool is to make the public view transparent while keeping the incident's missing facts visible.

References