Bullhorn shuts platform to stop cyberattack, affects 10,000 clients

Bullhorn disabled access to its entire staffing platform to contain a cyberattack that caused a system-wide outage. The company isolated the immediate threat and is now working with CrowdStrike specialists to restore services after conducting thorough security reviews. This action halted operations for thousands of recruitment firms relying on the cloud-based system for candidate tracking and payroll.

The risk

Issues began on Friday with job posting failures, escalating to a full outage by Saturday. Bullhorn confirmed the disruption was caused by a cyber incident. The company temporarily disabled system access to contain the activity. While the immediate threat has been eradicated, a forensic investigation is ongoing. Bullhorn has not yet determined if customer data was exfiltrated. If a breach is confirmed, affected individuals will be notified directly.

Who is exposed

Bullhorn serves more than 10,000 customers worldwide. Major outages affected ATS/CRM, Automation, Back Office, and Talent Platform services. Sandbox environments were also impacted. Some services, including Adapt, eEmpACT, and StaffSuite, remained operational. Degraded performance was reported for Bullhorn for Salesforce, Onboarding365, and additional solutions like Amplify and VMS Sync. Systems in the UK, US, and Australia are back online but facing login issues.

Cost and compliance

Bullhorn has not provided timelines for full service restoration. All non-SSO users must reset passwords on their next login. API passwords require rotation to protect integrations, while client-secret changes will follow later. For Bullhorn-hosted instances, these credential updates will take place automatically. Customers are advised to check the company’s service status page for the latest updates regarding specific product availability and performance levels.

What should you do?

Check your Bullhorn service status page for current performance levels of specific modules. Prepare to reset passwords for all non-SSO accounts and rotate API credentials immediately. Monitor official communications for updates on data exfiltration findings.

The background in plain language

When a software provider detects unauthorized access, disabling the platform is a standard containment measure. This prevents attackers from moving laterally or stealing more data while experts investigate. Forensic teams analyze logs to determine the scope of the intrusion. Credential resets are necessary because attackers may have captured login tokens or session cookies. Even if data wasn't stolen, compromised credentials allow future access. Teams usually verify integration secrets and API keys, as these often bypass standard user authentication controls.

What to do and how to stay safe: Bullhorn

• Verify the status of all Bullhorn-dependent integrations and automate credential rotation where possible.
• Monitor email and status pages for official notifications regarding confirmed data breaches.
• Review access logs for any unusual activity prior to the outage window.
• Ensure all non-SSO users have completed password resets before resuming full operations.

Step-by-step guide: Browser security settings are the architectural walls of your digital life

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did Bullhorn confirm that customer data was stolen?

No, Bullhorn stated it has not yet determined whether customer data was exfiltrated during the cyberattack.

Which Bullhorn services remain operational?

Adapt, eEmpACT, and StaffSuite remain operational, while most other services are under maintenance or have degraded performance.

Do I need to change my API passwords?

Yes, API passwords require rotation to protect integrations, and client-secret changes will follow later.