Bullhorn recruitment platform taken offline by cyberattack; CrowdStrike investigating, data theft unconfirmed
Bullhorn, a US-based recruitment software provider serving more than 10,000 customers, disabled access to its platform after detecting a cyber incident on October 16-17, 2026. The company engaged CrowdStrike to investigate and restore services. Systems are back online in the UK, US and Australia, but as of October 20 some users still had problems with SSO, password resets and customizations, and several products showed degraded performance. Bullhorn has not determined whether customer data was exfiltrated, has not named the attackers, and has not confirmed whether ransomware was involved. The cause of the intrusion is unknown.
Technical Details
- Problems began on Friday, October 16, when Bullhorn flagged difficulties posting jobs to Indeed. A full outage followed the next morning, when the company confirmed a cyber incident and disabled access to contain it.
- Customers lost access to candidate records, job applications, placements and, in some cases, payroll-related systems.
- Products still reporting degraded performance on October 20: automation tools, Talent Platform, Onboarding365 and Time & Expense.
- Bullhorn's forensic investigation is ongoing. It warned that threat actors may pose as Bullhorn staff by email, text or phone to harvest credentials or sensitive information, using the incident as a pretext.
Remediation
- Bullhorn required password resets for users who do not log in via SSO.
- Customers using API integrations must rotate their credentials.
- Treat unsolicited contact claiming to be from Bullhorn with suspicion. The company says its staff will never ask for passwords, MFA codes or verification tokens.
- Affected customers will be contacted directly if the investigation finds their data was compromised.
Linha do tempo
-
Bullhorn recruitment platform taken offline by cyberattack; CrowdStrike investigating, data theft unconfirmed
ler a análise desta fonte ocultar
Bullhorn, a US-based recruitment software provider serving more than 10,000 customers, disabled access to its platform after detecting a cyber incident on October 16-17, 2026. The company engaged CrowdStrike to investigate and restore services. Systems are back online in the UK, US and Australia, but as of October 20 some users still had problems with SSO, password resets and customizations, and several products showed degraded performance. Bullhorn has not determined whether customer data was exfiltrated, has not named the attackers, and has not confirmed whether ransomware was involved. The cause of the intrusion is unknown.
Technical Details
- Problems began on Friday, October 16, when Bullhorn flagged difficulties posting jobs to Indeed. A full outage followed the next morning, when the company confirmed a cyber incident and disabled access to contain it.
- Customers lost access to candidate records, job applications, placements and, in some cases, payroll-related systems.
- Products still reporting degraded performance on October 20: automation tools, Talent Platform, Onboarding365 and Time & Expense.
- Bullhorn's forensic investigation is ongoing. It warned that threat actors may pose as Bullhorn staff by email, text or phone to harvest credentials or sensitive information, using the incident as a pretext.
Remediation
- Bullhorn required password resets for users who do not log in via SSO.
- Customers using API integrations must rotate their credentials.
- Treat unsolicited contact claiming to be from Bullhorn with suspicion. The company says its staff will never ask for passwords, MFA codes or verification tokens.
- Affected customers will be contacted directly if the investigation finds their data was compromised.