The Bullhorn cyberattack has forced the staffing software company to disable platform access, disrupting recruitment and back-office services. The company took its systems offline to contain unauthorized activity while investigators assessed the incident.
Bullhorn says it has isolated the issue and eliminated the immediate threat. Meanwhile, its team is working with CrowdStrike specialists to review security before restoring services.
However, investigators have not yet determined whether attackers stole customer data. The company has also not announced a restoration timeline.
Job Posting Problems Escalated Into a Wider Outage
Customers first encountered problems with job posting on Friday, October 16. By the following day, Bullhorn reported a system-wide platform outage and later confirmed a cyberattack.
The company then temporarily disabled access to its systems as part of its containment response.
Bullhorn provides cloud-based software for staffing and recruitment firms. Its tools support candidate tracking, onboarding, payroll and other stages of the recruitment process.
According to the company, it serves more than 10,000 customers worldwide. However, that figure does not establish how many customers experienced disruption from this incident.
Recruitment and Back-Office Products Face Disruption
At the time of the October 19 report, major outages affected ATS/CRM, Automation, Back Office, Talent Platform and sandbox environments.
Meanwhile, Bullhorn for Salesforce and related products experienced degraded performance. Onboarding365 also faced reduced service availability.
Other affected solutions included Amplify, Analytics, Messaging, SourceBreaker, VMS Sync, Data Hub, Erecruit, SalesDuel and VMS Access.
However, Adapt, eEmpACT and StaffSuite remained operational. The disruption therefore varied across Bullhorn’s product portfolio.
For staffing firms, unavailable recruitment and administrative tools can interrupt several connected workflows. Bullhorn has offered support-assisted data exports to help customers reduce business disruption.
Investigators Have Not Confirmed Data Theft
Bullhorn has launched a forensic investigation into the attack. However, it has not established whether anyone removed customer information from its systems.
The company said it would notify affected individuals directly if investigators confirm a data breach.
That distinction remains important: the Bullhorn cyberattack caused a confirmed service disruption, but customer data theft remains unconfirmed.
Although Bullhorn says it has removed the immediate threat, security reviews and recovery work continue. The company has not provided a firm date for restoring affected services.
Password Resets and API Credential Rotation Follow
Bullhorn’s latest update requires users who do not use single sign-on to reset their passwords at their next login.
In addition, API passwords require rotation to protect integrations. Bullhorn said it would handle that process automatically for Bullhorn-hosted instances.
Changes to client secrets will follow later, according to the company’s incident FAQ. Customers therefore face separate credential updates as the recovery process progresses.
These measures form part of the response. They do not, by themselves, establish which credentials attackers may have accessed.
Customers Can Request Exports During Recovery
Customers who need access to their information can request data exports through Bullhorn support.
The company also said it would reprocess unposted time records after restoring services. Meanwhile, it plans to review service credits against applicable service-level agreements once it resolves the incident.
For now, restoration timing remains uncertain. Customers can follow Bullhorn’s service status updates for changes to individual products and further recovery instructions.
0 responses to “Bullhorn Cyberattack Forces Staffing Platform Offline as Investigation Continues”