"We have detected a cyber incident on the Bullhorn Platform. We have temporarily disabled access to our systems in order to contain the activity while we investigate further," Bullhorn told customers after an outage that began on October 16 and unfolded into a multi‑day service disruption.
Bullhorn's October 16–20 timeline
Problems began on Friday, October 16, when Bullhorn flagged difficulties getting job postings onto Indeed. By the following morning the situation had deteriorated into a full platform outage. Later that day Bullhorn announced the company had "detected a cyber incident" and had temporarily disabled access to contain the activity while it investigated.
Services began to return on Monday, and Bullhorn reported its systems were back online in the UK, US, and Australia. But as the company itself alerted customers, online access did not equate to full functionality: as of Tuesday morning the Bullhorn status page showed degraded performance across several products and some users still could not complete single sign‑on (SSO), password resets, or restore customizations.
Scope of the outage and customer impact
Bullhorn, which serves more than 10,000 customers worldwide, said the outage blocked recruitment agencies from accessing core functions. The Register reported affected features and records included candidate records, job applications, placements and, in some cases, systems used to get people paid.
The company named specific affected product areas on its status page: automation tools, Talent Platform, Onboarding365 and Time & Expense continued to report degraded performance even after basic access was restored. The practical result: customers could be logged in but still unable to complete key recruitment and payroll workflows.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleInvestigation, containment and controls enacted
Bullhorn engaged external cybersecurity support, bringing in specialists from CrowdStrike to assist with the investigation and service restoration. The company said a forensic investigation was ongoing and had not yet determined whether attackers exfiltrated customer data.
Operational measures Bullhorn implemented during and after containment included:
- Temporarily disabling access to systems to contain the activity;
- Requiring password resets for users who do not log in through SSO;
- Instructing customers using API integrations to rotate their credentials;
- Warning customers about potential impostor messages and instructing them that Bullhorn employees would never request passwords, multi‑factor authentication codes, or verification tokens.
The company also said it would contact customers directly if the ongoing forensic work finds their information was compromised. Bullhorn has not publicly identified the attackers, confirmed whether ransomware was involved, or announced a concluded forensic result; The Register reported that the company did not respond to its questions at publication time.
What this means for recruitment agencies, API integrators, and security teams
Recruitment agencies: agencies that rely on Bullhorn to manage candidate records, placements and payroll faced immediate operational disruption and temporary loss of critical workflows. Those agencies will be monitoring Bullhorn's forensic findings closely for any confirmation of data exposure and for direct notification if their information was compromised.
API integrators and customers using non‑SSO authentication: Bullhorn's guidance to rotate API credentials and to require password resets for non‑SSO users creates a short window of remediation actions that customers must complete to reduce exposure.
Security teams and incident responders: the involvement of CrowdStrike and the decision to disable platform access to contain the incident illustrate a containment‑first approach; security teams will be watching Bullhorn's forensic conclusions to learn whether data exfiltration occurred and what attack vectors were used.
Outstanding questions and immediate risks
The central unanswered question — whether attackers stole customer data — remains open. Bullhorn's customer FAQ says the forensic investigation is ongoing and that the company will contact affected customers if their data was compromised. In the meantime Bullhorn warned of opportunistic fraud: threat actors may impersonate company personnel via email, text or phone using the incident as a pretext to harvest credentials or sensitive information.
For customers the immediate risks are twofold: operational disruption until degraded services are fully restored, and the possibility of follow‑on phishing or fraud exploiting the confusion. Bullhorn's mandatory resets for some users and credential rotations for API clients are immediate mitigation steps intended to reduce that risk.
The outage may be moving toward recovery, but the investigation is not finished. Whether customer data was exposed, the identity and motive of the intruders, and whether the incident involved ransomware are all questions Bullhorn's ongoing forensic work must answer — and customers will be watching for those answers as they try to restore normal recruiting and payroll operations.
Source: The Register — Bullhorn sees red after cyberattack knocks recruitment platform offline
