Bullhorn Recruitment Platform Faces Major Outage Following Cyberattack
Global recruitment software provider Bullhorn struggles to restore services after a significant security incident.
1Initial Platform Outage Detected
The disruption began on Friday, October 16, when Bullhorn identified issues with job postings on Indeed. By Saturday morning, the situation escalated into a full-scale platform outage. The company confirmed a cyber incident occurred, forcing them to temporarily disable system access to contain the unauthorized activity and initiate a comprehensive forensic investigation.
2CrowdStrike Engaged for Investigation
Bullhorn has enlisted cybersecurity specialists from CrowdStrike to assist in the ongoing investigation and service restoration process. While systems are now back online in the US, UK, and Australia, the recovery remains incomplete. The company is working to address persistent technical issues while determining the full scope of the security breach.
3Operational Impact on Agencies
The outage severely disrupted recruitment agencies by blocking access to candidate records, job applications, and placement data. Crucially, some firms lost access to systems responsible for payroll processing. This downtime created significant operational bottlenecks, as agencies could not manage their core workflows or facilitate essential hiring tasks for their global clients.
4Ongoing Performance Degradation Issues
As of Tuesday, Bullhorn reported that several products still suffer from degraded performance. Users continue to face difficulties with single sign-on authentication, password resets, and platform customizations. Specific tools, including the Talent Platform, Onboarding365, and Time & Expense modules, remain unstable, hindering the ability of customers to resume their standard business operations.
5Data Exfiltration Status Unknown
Bullhorn has not yet confirmed whether attackers successfully exfiltrated customer data during the breach. The forensic investigation is currently ongoing to determine if sensitive information was compromised. The company has committed to contacting affected customers directly if the investigation reveals that their personal or business data was accessed by the unauthorized threat actors.
6Security Precautions and Credentials
To mitigate further risks, Bullhorn has mandated password resets for users who do not utilize single sign-on. Additionally, customers relying on API integrations have been instructed to rotate their credentials immediately. These measures are designed to secure user accounts against potential unauthorized access while the company continues to stabilize its overall platform infrastructure.
7Phishing Risks During Chaos
Bullhorn warned customers to remain vigilant against opportunistic attackers who may pose as company personnel. Threat actors might use the incident as a pretext to solicit credentials or sensitive verification tokens via email or phone. The company explicitly stated that its employees will never request passwords or multi-factor authentication codes from their users.
8Unresolved Questions Remain
Despite the return of some services, the root cause of the intrusion remains unidentified. Bullhorn has not disclosed whether ransomware was involved or publicly named the attackers responsible for the disruption. As the investigation continues, the focus remains on restoring full functionality and ensuring the long-term integrity of the recruitment platform's ecosystem.