Bullhorn: Cyberattack forced recruitment platform offline with possible data theft (no CVE)
Severity: high · Patch status: no-fix-needed · Since 2026-10-16
Bullhorn, a US-based staffing/recruitment software provider serving over 10,000 customers, suffered a cyber incident first flagged on 2026-10-16 via job-posting failures to Indeed, escalating to a full outage on 2026-10-17. The company disabled access to contain the activity and engaged CrowdStrike to investigate and restore services. Systems returned online in the UK, US, and Australia from Monday, but SSO issues, password resets, and degraded performance persisted across products including Talent Platform, Onboarding365, and Time & Expense. Recruitment agencies lost access to candidate records, applications, placements, and payroll systems. A forensic investigation has not yet determined whether customer data was exfiltrated; attackers and ransomware involvement remain unidentified. Bullhorn has forced password resets for non-SSO users and instructed API customers to rotate credentials.
What to do
- Rotate API integration credentials immediately if you use Bullhorn APIs
- Complete forced password resets and verify MFA is enabled on all accounts
- Beware phishing posing as Bullhorn staff requesting passwords, MFA codes, or tokens; verify via official channels
- Monitor Bullhorn's status page and incident communications for data-breach notifications
- Review access logs and watch for anomalous activity in downstream systems fed by Bullhorn data
- Prepare contingency workflows for candidate records and payroll in case of renewed disruption
Sources
All live incidents on Threat Watch
