Key points
- Bullhorn disabled platform access to contain a cyberattack affecting its global customer base.
- CrowdStrike specialists are assisting with forensic investigations and service restoration.
- The company has not yet determined if customer data was exfiltrated during the incident.
Bullhorn temporarily shut down its recruitment software platform to stop a cyberattack from spreading further. The staffing technology company serves more than 10,000 customers worldwide, and the outage prevented many from accessing critical hiring and payroll tools. The firm has since isolated the threat and is working to restore services, but full functionality remains limited as security reviews continue.
How it unfolded
- On Friday, October 16, customers reported issues posting jobs to Indeed through the Bullhorn application.
- By Saturday, the company confirmed a system-wide outage and identified the cause as a cyber incident.
- Bullhorn disabled access to its systems to contain the activity while CrowdStrike specialists began an investigation.
Who is affected
More than 10,000 staffing firms rely on Bullhorn’s cloud-based solutions for candidate tracking, onboarding, and payroll management. The outage disrupted access to candidate records, job applications, and placement data for these organizations. While services in the US, UK, and Australia are partially back online, many users still face login difficulties and degraded performance across several products.
What happens next
Bullhorn is conducting thorough security reviews with help from CrowdStrike before fully restoring all services. Most major services, including ATS/CRM and Automation, remain under maintenance or show degraded performance. Only Adapt, eEmpACT, and StaffSuite are currently operational. The company has not provided a specific timeline for when all features will return to normal status.
The background in plain language
When a company detects unauthorized access, it often takes systems offline to prevent attackers from moving deeper into the network. This containment step stops data theft but disrupts business operations. Security teams then perform forensic analysis to understand how the breach occurred and what data might be exposed. Restoring services requires verifying that all threats are removed and that system integrity is fully recovered before allowing users back in.
Background: Unauthorized access
Yes, they are different. Unauthorized access means entering a system without permission. Unauthorized use means entering with permission but acting beyond allowed boundaries. Access violations trigger perimeter alerts. Use violations require behavioral analysis to detect, as the actor already possesses valid credentials and expected network presence.
Read the full guide: Difference Between Unauthorized Access and Unauthorized Use Explained
What to do and how to stay safe: Bullhorn
- Check your organization’s service status page for the latest updates on system availability and restoration timelines.
- Prepare to reset passwords for all non-single sign-on user accounts upon your next login to the platform.
- Rotate API passwords immediately to protect integrations, as client-secret changes will follow for hosted instances.
- Monitor official communications for notifications regarding potential data breaches or confirmed exfiltration of customer information.
Step-by-step guide: Mobile Device Security for Small Business: Control Without Cost
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Has Bullhorn confirmed if customer data was stolen?
No, the company stated in its FAQ that it has not yet determined whether customer data was exfiltrated during the incident.
Which Bullhorn services are currently working?
Adapt, eEmpACT, and StaffSuite remain operational, while most other services are under maintenance or experiencing degraded performance.
Do users need to change their passwords?
Yes, all non-SSO users are required to reset their passwords on their next login, and API passwords require rotation.
