"We have detected a cyber incident on the Bullhorn Platform. We have temporarily disabled access to our systems in order to contain the activity while we investigate further," Bullhorn said in an update to customers.
Bullhorn's containment decision and current posture
Bullhorn, the American cloud-based staffing and recruitment software company, has taken its platform offline after detecting a cyberattack that led to a system-wide outage. The company says it has isolated the issue and "eradicated the immediate threat." Bullhorn declined to provide a restoration timeline; instead it says its team is working to restore services following thorough security reviews conducted with help from CrowdStrike specialists.
Services affected: outages, degraded performance, and exceptions
According to Bullhorn’s status page, customers first experienced problems with job posting on Friday; the following day the company reported a system-wide outage and later confirmed the cause as a cyberattack. Major outages currently affect ATS/CRM, Automation, Back Office, Talent Platform, and sandbox environments. Several other products are reporting degraded performance, including Bullhorn for Salesforce, Onboarding365, Amplify, Analytics, Messaging, SourceBreaker, VMS Sync, Data Hub, Erecruit, SalesDuel, and VMS Access.
Bullhorn notes that some products remain operational: Adapt, eEmpACT, and StaffSuite. Customers are instructed to check the company’s service status page for the latest updates.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleInvestigation, CrowdStrike involvement, and data-exfiltration status
Bullhorn has initiated a forensic investigation and engaged CrowdStrike specialists to assist with security reviews. The company says it has "not yet determined whether customer data was exfiltrated" and has pledged to notify affected individuals directly if a data breach is confirmed. The investigation is ongoing; Bullhorn has not released technical details about the nature of the attack or the methods used.
BleepingComputer has contacted Bullhorn to request more information about the attack and said it will update its post when a response is received.
Operational steps for customers: passwords, API rotations, and business continuity
Bullhorn has set immediate operational requirements and temporary workarounds for customers. The company says all non-SSO users will be required to reset their passwords on their next login. API passwords must be rotated to protect integrations, and client-secret changes will follow later; Bullhorn says those changes will occur automatically for Bullhorn-hosted instances. Customers can request data exports through Bullhorn support to minimize business disruption.
Bullhorn also said unposted time records will be reprocessed after services are restored, and that service credits will be reviewed against applicable SLAs once the incident is resolved.
What this means for security teams, procurement leaders, and end users
- Security teams and technologists: Expect to prioritize credential hygiene — password resets for non-SSO users, API password rotation, and forthcoming client-secret changes — while reviewing forensic findings from CrowdStrike and Bullhorn. The incident underscores the challenge of containment when systems are taken offline to eradicate an immediate threat.
- Procurement leaders and affected enterprises: Organizations that rely on Bullhorn for recruitment lifecycle management should prepare to request data exports through support, track reprocessing of unposted time records, and expect SLA review for service credits after resolution.
- End users (recruiters, payroll staff, candidates): Users should anticipate required password resets at next login and possible interruptions to job posting, onboarding, payroll, and other recruitment workflows until Bullhorn restores full service.
The episode leaves a narrow but concrete set of open points: whether customer data was exfiltrated, the detailed timeline for restoring the full suite of products, and the forensic findings that will inform any further mitigations. Bullhorn’s status page and its communications to customers remain the primary sources for those answers; customers and observers are urged to monitor updates closely.
