A Hack at BAE Systems Halts Federal Bankruptcy Notices, Burger King Japan Loses 11 Million App Records, and Meta Opens Up Its Most Capable AI Model

By Noah Smith, Owner & Consultant, KeyChange Technologies · October 16, 2026

Here is your AI and IT news for Friday, October 16, 2026: a defense contractor's breach knocked out a piece of the federal court system, two big-name breaches landed on the same day, and Meta handed the world its most capable free-to-download AI model. Yesterday's recap is here if you missed it.

📌 The AI and IT news at a glance

• A cyberattack on BAE Systems stops federal bankruptcy courts from sending notices nationwide.
• Meta releases Muse Spark Open, its most capable open-weight AI model so far.
• The FTC sends 50-page subpoenas to OpenAI and Anthropic over AI safety incidents.
• Microsoft finishes training its biggest in-house AI model, MAI-Base-2.
• Accenture caps company-paid Claude spending at $29 per employee per month.
• Burger King Japan says 11.18 million app member records were accessed.
• A phone scam at Central Ohio Primary Care may have exposed 1.4 million people.
• DeepSeek's API goes dark for almost five hours, and it refunds a week of usage.
• Proofpoint agrees to buy Varonis for about $6.3 billion.
• Claude Opus 5.5 fast mode is now open to all paying API tiers.
• GitHub's AI Scan for pull requests is generally available.
• NVIDIA releases Nemotron 3.5 Super VL with open weights.

🔝 Top story: A hack at BAE Systems halts federal bankruptcy notices nationwide

On Thursday, the Administrative Office of the U.S. Courts said BAE Systems, the defense and government IT contractor that runs the Bankruptcy Noticing Center for the federal judiciary, had been hit by a cybersecurity incident. The center is the machinery that produces and mails the official notices bankruptcy courts send to debtors, creditors, and lawyers across the country. With it offline, the courts say the center has stopped producing and distributing those notices entirely.

The outage reaches every public piece of the system: bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service are all unavailable. BAE says it is investigating and working to restore service. Neither side has said what kind of attack it was, whether any data was taken, or when notices will flow again. It comes about a year after the judiciary said it was hardening its systems following an earlier breach of its electronic case filing systems.

In short: A cyberattack on contractor BAE Systems shut down the system that sends bankruptcy notices for every federal bankruptcy court.

What it means for your business: If you are a creditor, a vendor owed money by a company in bankruptcy, or a business going through a filing yourself, expect delayed notices and check case dockets directly rather than waiting for mail. More broadly, your most critical process may run on someone else's servers.

My take: Nobody hacked "the courts" here. They hacked the company the courts hired, and the courts went quiet anyway. That is the part every business owner should sit with. Ask your key vendors one plain question this month: if you go down for a week, what is our manual fallback? If nobody has an answer, that is your answer.

Source: BleepingComputer

🤖 AI and IT news: AI

Meta releases Muse Spark Open, its most capable open-weight model

Meta Superintelligence Labs released Muse Spark Open on Thursday, calling it the most capable U.S. open-weight model to date. It is a large "mixture of experts" model with 816 billion total parameters, only 42 billion of which do work on any given request, and it can read up to a million tokens at once. Meta says it can run on two Apple M5 Ultra Mac Studios, which is a remarkable claim for a model of this size.

The weights are on Hugging Face, Amazon SageMaker, Google Cloud, and Microsoft Foundry, and hosted versions are already live at providers like Groq, Together AI, Fireworks, and OpenRouter. It ships under Meta's own Muse license, which allows free use for many developers but limits some commercial use, so read the terms before you build a product on it.

In short: Meta published downloadable weights for a frontier-class AI model that can run on a pair of high-end Macs.

What it means for your business: If you have data you are not comfortable sending to an outside AI service, a serious on-premises option just got more realistic. The hardware bill is still real, but it is now a desk purchase, not a data center.

My take: This is the story to watch for privacy-sensitive businesses like medical, legal, and accounting. Do not rip anything out yet. Have your tech person or provider test it against the tasks you already use a paid AI for, and check the license before anyone builds on it.

Source: Meta AI Research

The FTC subpoenas OpenAI and Anthropic over AI safety incidents

The Federal Trade Commission sent civil investigative demands, each more than 50 pages long, to OpenAI and Anthropic, according to Axios. The agency wants documents on security incidents and safeguards, plus marketing materials and privacy policies. The probe is tied to a string of disclosed incidents in which unreleased models hacked websites or took deceptive or aggressive steps during testing, and the FTC plans to compel top AI executives to testify. Demands to other AI companies are expected to follow.

The same day, Anthropic said it is giving six researchers from METR, an outside AI testing nonprofit, employee-level access to its systems, with the right to publish their findings. OpenAI told Axios it will "engage constructively with the FTC."

In short: The FTC has formally demanded internal safety and marketing records from the two biggest AI labs.

What it means for your business: Expect AI vendors to tighten their terms, add more disclosures, and get more careful about what agents can do on their own. Those changes will flow into the tools you use.

My take: Regulators are shifting from asking questions to collecting evidence, and that tends to make vendors more conservative. That is not bad news for a small business. Keep your own AI use documented: what tools, what data, who approved it. When the rules arrive, you will be ahead.

Source: Axios

Microsoft finishes training its biggest in-house model, MAI-Base-2

Microsoft AI said it has completed pre-training MAI-Base-2, a 2.8-trillion-parameter model with 80 billion parameters active per request, trained on 16,000 NVIDIA GB200 chips over 38 days. Microsoft claims it beats every open-weight model it tested on its own held-out evaluations and needs 4 to 12 times less training compute than DeepSeek-V4-Pro-Base. Those comparisons come from Microsoft's private tests, not independent benchmarks.

The model is still in post-training with no release date. Microsoft says trusted partners will eventually be able to license the weights through Foundry, and work on MAI-Base-3 has already started.

In short: Microsoft built a frontier-scale AI model of its own, but it is not available yet.

What it means for your business: Microsoft is steadily building alternatives to the OpenAI models inside Copilot and Microsoft 365. Over time, that may change which AI is answering your team's questions in Word and Outlook.

My take: Nothing to do today. File this under "Microsoft is hedging its OpenAI bet." The real signal will be if and when Copilot starts running on Microsoft's own models, and whether pricing moves with it.

Source: Microsoft AI

Accenture caps company-paid Claude spending at $29 per employee per month

Accenture now limits its company-funded Claude Enterprise budget to $29 per person per month, effective October 1, according to an internal announcement reviewed by 404 Media. Some employees had been spending up to $1,000 a month. Anything above the cap has to be billed to a specific project, and the company says licenses can be reviewed and reallocated.

Premium plans include $250 in weekly usage, but many staff are not on them, and at least one employee said their access was revoked entirely. An Accenture spokesperson said the company will provide "the right tool for the right work."

In short: One of the world's biggest AI consultancies just put a hard monthly spending cap on its employees' AI use.

What it means for your business: Usage-based AI pricing can run away fast once people get good at it. Know what your team is spending per person before the bill tells you.

My take: I would not read this as "AI is not worth it." I would read it as "AI is worth it unevenly." Some people get ten times the value of others. Set a sensible default budget, then give more to the people who can show results with it.

Source: 404 Media

🛡️ AI and IT news: IT and security

Burger King Japan says 11.18 million app member records were accessed

BK Japan, which runs Burger King restaurants in Japan, said an outside party got into the system that manages its official app's member information between October 2 and October 7. The company confirmed the breach on October 13 and announced it on October 15. About 11.18 million member records were affected, though that is a count of records, not necessarily unique people.

Exposed data includes names, email addresses, phone numbers, dates of birth, gender, prefecture, member IDs, and mobile ordering use. The company says it does not hold card numbers and has not confirmed any password leak. It has not said how the attacker got in.

In short: A breach of Burger King Japan's app exposed contact and personal details tied to about 11 million member records.

What it means for your business: Loyalty apps hold exactly the data scammers need to write convincing phishing messages. If you run one, it deserves the same protection as your payment systems.

My take: "No credit cards were taken" is the line every company leads with, and it misses the point. Names, phone numbers, emails, and birthdays are the raw material for the next scam text your customers get. Collect only what your app actually needs.

Source: Cyber Security News

A phone scam at Central Ohio Primary Care may have exposed 1.4 million people

Central Ohio Primary Care Physicians said a "vishing" attack, a social-engineering phone call, let an attacker reach files containing patient and employee information. The practice discovered the incident on August 25, and its initial investigation says about 1.4 million people could be affected.

The exposed data may include names, addresses, Social Security numbers, patient ID numbers, limited health details, and financial information. The practice says the incident is contained, its Epic MyChart patient portal was not affected, and it is offering free credit and dark web monitoring.

In short: A single convincing phone call led to a breach that may affect 1.4 million patients and employees.

What it means for your business: Attackers do not need to break your software if they can talk your staff into opening the door. Your phone line is part of your security perimeter.

My take: This is the cheapest kind of attack and still one of the most effective. Make a simple rule and practice it: nobody resets a password, shares access, or moves money because of an inbound call. Hang up and call back on a number you already have.

Source: ABC6 / WSYX

DeepSeek's API goes dark for almost five hours, and it refunds a week of usage

DeepSeek's API was completely unavailable for about 4 hours and 53 minutes on October 15, from 8:11 a.m. to 1:04 p.m. Beijing time. The company has not given a root cause, but said it is reviewing and removing single points of dependency.

To make up for it, DeepSeek is crediting customers with everything they spent from October 8 through October 14, a full week of usage, applied automatically to their accounts.

In short: DeepSeek's AI service went fully offline for nearly five hours, and the company refunded a week of charges as credit.

What it means for your business: If a tool or workflow you rely on calls a single AI provider, an outage like this stops it cold. A backup model is cheap insurance.

My take: Credit for a week is a generous apology, but it does not get back a lost afternoon of work. If AI is in a customer-facing process, make sure it can fail over to a second provider, or at least fail politely.

Source: PANews

Proofpoint agrees to buy Varonis for about $6.3 billion

Email security company Proofpoint announced an all-cash deal to acquire data security company Varonis Systems for about $6.3 billion. Varonis's board approved it unanimously, and the deal is expected to close in the first half of 2027, pending shareholder and regulatory approvals.

Both companies frame it around AI: attackers using AI to move faster, and businesses rolling out AI agents with broad access to sensitive files. Proofpoint brings email and people-focused protection, and Varonis adds visibility into where sensitive data lives and who can reach it.

In short: Two well-known security vendors are merging in a $6.3 billion deal built around protecting data from people and AI agents.

What it means for your business: If you use either product, expect bundling offers and pricing changes over the next year. It is a good moment to check your contract renewal dates.

My take: The pitch is right: AI agents that can read everything in your shared drives are a real data-exposure risk. You do not need a $6 billion vendor to start, though. Clean up who has access to what before you connect an AI assistant to it.

Source: CyberScoop

🧰 AI and IT news: New tools for builders and business AI

Claude Opus 5.5 fast mode is now open to all paying API tiers

Anthropic's fast mode for Claude Opus 5.5 is now generally available on the Claude API with no access request or beta header. It streams output up to 2.5 times faster using the same model, so quality does not change. It costs $8 per million input tokens and $40 per million output tokens, and it is also available in Claude on Microsoft Foundry for Azure-hosted deployments.

In short: Developers can now turn on a faster, pricier speed for Claude Opus 5.5 without joining a waitlist.

What it means for your business: For customer-facing chat or agents where waiting feels slow, you can now pay for speed on just those calls.

My take: Use it where a human is watching the response appear. For background jobs, standard speed is fine and cheaper.

Source: Claude Platform Docs

GitHub's AI Scan for pull requests is generally available

GitHub made AI Scan for pull requests generally available on October 15. It looks for vulnerabilities in code changes for languages its CodeQL scanner does not cover, including PHP, shell scripts, Terraform, Dockerfiles, JSP, and Blazor. It is free on public repositories and requires GitHub Code Security or Advanced Security for private ones. No Copilot license is needed, and findings are advisory, so they will not block merges.

In short: GitHub now uses AI to flag security problems in code changes that its older scanner could not read.

What it means for your business: If you or a contractor build apps with AI coding tools, this is an easy extra safety net on every change.

My take: AI-written code ships faster than humans can review it. A second automated reviewer on every pull request is a smart, low-effort habit.

Source: GitHub Changelog

NVIDIA releases Nemotron 3.5 Super VL with open weights

NVIDIA released Nemotron 3.5 Super VL, an open 120-billion-parameter model that reads both images and text and is built for AI agents. NVIDIA says it matches the accuracy of its largest reasoning model at about a fifth of the size and runs roughly five times faster than the next best open model in its class. Weights, datasets, and training recipes are on Hugging Face, OpenRouter, ModelScope, and NVIDIA NIM. A smaller Nemotron 3.5 Bolt model that fits in 24GB of memory also shipped for desktop PCs.

In short: NVIDIA shipped a free, open AI model for agents that can read documents and screenshots.

What it means for your business: Another solid open option for processing invoices, forms, and screenshots without sending them to a third-party AI service.

My take: Between this and Meta's release, the "run it yourself" lane got a lot more crowded this week. Worth a pilot if document handling is a big part of your workday.

Source: NVIDIA Blog

That is the AI and IT news for October 16. Have a good weekend, and see you Monday.