Bullhorn, whose software staffing agencies use to track candidates, place workers and run payroll, cut off access to its platform after detecting a cyberattack. It is now bringing services back with forced password resets and new API credentials. Recruiters and their IT teams face a working week of logins, integration fixes and questions from clients about their data.
The company has not yet determined whether customer data was taken. BleepingComputer reported on 19 October that Bullhorn had isolated the issue and was restoring services after security reviews with CrowdStrike. Bullhorn says it serves more than 10,000 customers.
In brief
- Bullhorn disabled access to its staffing platform after detecting a cyber incident and is restoring it with help from CrowdStrike.
- Non-SSO users must reset their passwords, and API passwords for integrations are being rotated; customers who host their own integrations must update and redeploy them.
- Bullhorn says it has not yet determined whether customer data was exfiltrated, and it has not said who was behind the attack or how they got in.
From a job-board glitch to a shutdown
The trouble surfaced on Friday 16 October as a problem with job postings syncing to Indeed, according to Bullhorn’s status page. By Saturday morning it was reporting “a system-wide outage affecting the Bullhorn platform”.
Later on Saturday, Bullhorn confirmed the cause. “We have detected a cyber incident on the Bullhorn Platform. We have temporarily disabled access to our systems in order to contain the activity while we investigate further,” it said, adding that it was working with cybersecurity specialists from CrowdStrike.
In its customer FAQ, Bullhorn says it “isolated the issue and eradicated the immediate threat”. It says the incident affected Bullhorn ATS/CRM, and that there is no indication its other products, including its Salesforce-based tools, Automation, SourceBreaker and VMS Sync, were affected. BleepingComputer, citing the status page, reported major outages across ATS/CRM, Automation, Back Office, Talent Platform and sandbox environments, while Adapt, eEmpACT and StaffSuite stayed up.
Services are returning in stages
When BleepingComputer published, Bullhorn had given no timeline for restoration. Later on Monday, its status page said ATS/CRM in Australia, EMEA/UK and the US was “now online”, although some customers using single sign-on were having trouble logging in. It said Talent Platform remained offline because of “proactive changes” to the network, with an estimated return of 6:00 pm Eastern time (23:00 UK time). Bullhorn says it has seen no evidence of cyber activity on Talent Platform.
The FAQ warns that restoration times may change and that Bullhorn cannot give estimates beyond those posted on the status page. It also says Bullhorn removed the underlying technology behind “a significant number of features” while reducing risk, so some functions are limited while they are rebuilt.
The data question remains open
The question customers most need answered is still open. “Our forensic investigation is ongoing, and we have not yet determined whether customer data was exfiltrated,” Bullhorn says. It promises to contact customers if their data is affected and to meet its notification obligations.
That matters well beyond Bullhorn. Staffing firms hold candidates’ CVs, contact details and placement records, and many have their own contractual duties to clients. Bullhorn says firms with those obligations should open a support ticket so it can track their requirements.
What Bullhorn customers should do now
Based on Bullhorn’s status page and FAQ, these are the practical steps:
- Reset your password when prompted. Non-SSO users must set a new password at login, using two-factor authentication. Wait about a minute after resetting before logging in, because the new credentials take time to spread across Bullhorn’s systems. Back Office (BBO) passwords have not been reset.
- Rotate API credentials. Bullhorn has expired API user passwords. Log into ATS/CRM with the API user to create a new password and complete email verification. If you or a third party host an integration, update the credentials in your code or configuration and redeploy. Bullhorn will handle integrations it hosts itself.
- Watch for the Client Secret change. Bullhorn says all customers will eventually have to update their Client Secret, but not yet. Integrations will keep working until then.
- Treat unexpected contact with suspicion. Bullhorn warns that criminals may pose as its staff and says it “will never ask you to share your password, Multi-Factor Authentication (MFA) codes, or verification tokens” by any channel.
- Plan around the status page. Use status.bullhorn.com for timings. Request data exports through support if you need them, and expect unposted time records to be reprocessed once systems are back.
Our read
This is TSN’s analysis. Bullhorn has moved quickly on containment and credential resets, but staffing firms will judge the outcome on the forensic findings. Until Bullhorn says whether candidate and client data left its systems, customers with their own notification duties are left waiting. The next update that matters is not the restoration ETA but the exfiltration answer.
Sources
- BleepingComputer (Bill Toulas): Bullhorn takes staffing platform offline to contain cyberattack, 19 October 2026
- Bullhorn status page
- Bullhorn Platform Incident: Customer FAQ, last updated 19 October 2026
Related stories
- Compromised ConnectWise Cloud Backup Credential Used to Access M365 Tenants
- Ahold Delhaize Says Outage Came From ‘Malicious Actions of Others’
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
