Bullhorn disables platform access to contain cyberattack causing system-wide outage

Staffing software provider Bullhorn has disabled access to its cloud-based platform to contain a cyberattack that caused a system-wide outage. According to BleepingComputer, the company isolated the immediate threat and is now conducting security reviews with assistance from CrowdStrike specialists.

The incident began on Friday when customers reported issues with job posting features in the Bullhorn application. By the following day, the company confirmed it was experiencing a system-wide outage affecting its entire platform. Bullhorn stated it detected a cyber incident and temporarily disabled access to its systems to contain the activity while investigations continue.

Operational Impact and Service Status

Bullhorn serves more than 10,000 customers worldwide who rely on its platform for recruitment lifecycle management, including candidate tracking, onboarding, and payroll. The outage has severely impacted most of the company’s services. According to the firm’s status page, major outages affect the Applicant Tracking System (ATS), Customer Relationship Management (CRM) tools, Automation services, Back Office functions, the Talent Platform, and sandbox environments.

Some services remain operational despite the broader disruption. Adapt, eEmpACT, and StaffSuite are currently functioning. However, degraded performance has been reported for Bullhorn for Salesforce and associated products. Other solutions experiencing reduced performance include Onboarding365, Amplify, Analytics, Messaging, SourceBreaker, VMS Sync, Data Hub, Erecruit, SalesDuel, and VMS Access.

Data Breach Investigation and Next Steps

Bullhorn has not provided a timeline for when these services will be restored. The company has initiated a forensic investigation but has not yet determined whether customer data was exfiltrated during the incident. According to the company’s FAQ page, Bullhorn promised to notify affected individuals directly if a data breach is confirmed.

When services are restored, users will face mandatory credential changes. All non-single sign-on (SSO) users will be required to reset their passwords upon their next login. Additionally, API passwords require rotation to protect integrations. Client-secret changes will follow later. For Bullhorn-hosted instances, these credential updates will take place automatically.

What should you do?

Monitors for service status updates are essential for organizations relying on Bullhorn’s recruitment tools. Staff should prepare for mandatory password resets and API credential rotations once access is restored. Verify whether your organization uses SSO to determine if manual password changes are required. Check for any communication from Bullhorn regarding potential data exposure.

What to do and how to stay safe: Bullhorn

• Monitor Bullhorn’s official status page for updates on service restoration timelines.
• Prepare to rotate API passwords and client secrets to secure integrations once access is granted.
• Reset passwords for all non-SSO user accounts immediately upon regaining platform access.
• Review internal logs for any unusual activity related to Bullhorn integrations prior to the outage.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Has Bullhorn confirmed if customer data was stolen?

No, Bullhorn has stated that it has not yet determined whether customer data was exfiltrated during the cyber incident.

Which Bullhorn services are currently operational?

Adapt, eEmpACT, and StaffSuite remain operational, while most other services are under maintenance or experiencing degraded performance.

When will Bullhorn services be restored?

Bullhorn has not provided a specific timeline for service restoration; customers are advised to check the company’s service status page for updates.