Bullhorn takes staffing platform offline after cyberattack, orders password resets

Bullhorn, a U.S.-based provider of cloud staffing and recruitment software, has taken its platform offline to contain a cyberattack that caused a system-wide outage, BleepingComputer reported on October 19. The company, which says it serves more than 10,000 customers worldwide with tools for candidate tracking, onboarding and payroll, has not yet determined whether customer data was stolen.

What happened

According to BleepingComputer, customers began having trouble posting jobs in the Bullhorn application on Friday, based on the company's status page. The following day, Bullhorn said it was "experiencing a system-wide outage affecting the Bullhorn platform," and later confirmed that it had "detected a cyber incident on the Bullhorn Platform."

Bullhorn temporarily disabled access to its systems to contain the activity. The company says it has isolated the issue and removed the immediate threat, and it is working to restore services after security reviews carried out with CrowdStrike specialists. A forensic investigation is under way, and Bullhorn's FAQ states that it has "not yet determined whether customer data was exfiltrated." The company said it will notify affected individuals directly if a data breach is confirmed.

BleepingComputer's report does not mention ransomware, an extortion demand or any group claiming responsibility, and the attackers have not been identified. No restoration timeline has been given.

Who is affected

At the time of BleepingComputer's report, Bullhorn's status page listed major outages for ATS/CRM, Automation, Back Office, Talent Platform and sandbox environments. Bullhorn for Salesforce, Onboarding365, Amplify, Analytics, Messaging, SourceBreaker, VMS Sync, Data Hub, Erecruit, SalesDuel and VMS Access were reported as degraded, while Adapt, eEmpACT and StaffSuite remained operational.

Because staffing platforms hold large volumes of candidate and employee information, including onboarding and payroll records, the outcome of the forensic investigation will matter for the customers' own obligations toward the people whose data they process.

What to do

Bullhorn has told customers to take several steps, according to BleepingComputer:

• All non-SSO users must reset their passwords at their next login.
• API passwords must be rotated to protect integrations; client-secret changes will follow later, and for Bullhorn-hosted instances this happens automatically.
• Customers can request data exports through support to reduce business disruption.

Unposted time records will be reprocessed after services are restored, and service credits will be reviewed against applicable SLAs once the incident is resolved. Organizations using Bullhorn should also review logs of integrations that connect to the platform, watch for phishing that impersonates Bullhorn support during the outage, and follow the company's status page for updates.