Bullhorn takes staffing platform offline after cyberattack; data exfiltration not yet ruled out
Bullhorn, a US cloud staffing and recruitment software vendor serving more than 10,000 customers, disabled access to its platform after detecting a cyber incident that caused a system-wide outage. Customers first saw job posting problems on Friday, and the company confirmed the cyberattack the following day. Bullhorn says it has isolated the issue and eradicated the immediate threat, and it is restoring services after security reviews with CrowdStrike. A forensic investigation is under way, and the company has "not yet determined whether customer data was exfiltrated." No restoration timeline has been given, and no attribution or attack vector has been disclosed.
Detalhes técnicos
- Major outages affect ATS/CRM, Automation, Back Office, Talent Platform and sandbox environments.
- Degraded performance was reported for Bullhorn for Salesforce, Onboarding365, Amplify, Analytics, Messaging, SourceBreaker, VMS Sync, Data Hub, Erecruit, SalesDuel and VMS Access.
- Adapt, eEmpACT and StaffSuite remain operational.
- The initial access vector, malware and threat actor are not disclosed.
Remediação
- All non-SSO users must reset their passwords at next login.
- API passwords require rotation to protect integrations. This happens automatically for Bullhorn-hosted instances, and client-secret changes will follow later.
- Customers can request data exports through Bullhorn support to limit business disruption.
- Unposted time records will be reprocessed after restoration, and service credits will be reviewed against SLAs.
- Customers should monitor the Bullhorn status page and FAQ for updates.
Linha do tempo
-
Bullhorn takes staffing platform offline after cyberattack; data exfiltration not yet ruled out
ler a análise desta fonte ocultar
Bullhorn, a US cloud staffing and recruitment software vendor serving more than 10,000 customers, disabled access to its platform after detecting a cyber incident that caused a system-wide outage. Customers first saw job posting problems on Friday, and the company confirmed the cyberattack the following day. Bullhorn says it has isolated the issue and eradicated the immediate threat, and it is restoring services after security reviews with CrowdStrike. A forensic investigation is under way, and the company has "not yet determined whether customer data was exfiltrated." No restoration timeline has been given, and no attribution or attack vector has been disclosed.
Technical Details
- Major outages affect ATS/CRM, Automation, Back Office, Talent Platform and sandbox environments.
- Degraded performance was reported for Bullhorn for Salesforce, Onboarding365, Amplify, Analytics, Messaging, SourceBreaker, VMS Sync, Data Hub, Erecruit, SalesDuel and VMS Access.
- Adapt, eEmpACT and StaffSuite remain operational.
- The initial access vector, malware and threat actor are not disclosed.
Remediation
- All non-SSO users must reset their passwords at next login.
- API passwords require rotation to protect integrations. This happens automatically for Bullhorn-hosted instances, and client-secret changes will follow later.
- Customers can request data exports through Bullhorn support to limit business disruption.
- Unposted time records will be reprocessed after restoration, and service credits will be reviewed against SLAs.
- Customers should monitor the Bullhorn status page and FAQ for updates.