What Bullhorn has confirmed
Bullhorn, a cloud staffing and recruitment vendor, disabled access to its platform to contain a cyberattack that caused a system-wide outage. The company's status page shows the sequence. On Saturday, October 17, Bullhorn first posted that it was experiencing a system-wide outage, and users might be unable to access Bullhorn or might see errors and degraded performance. Later that day it said it had detected a cyber incident and temporarily disabled access to its systems to contain the activity while it investigated. It added that it was working with cybersecurity specialists from CrowdStrike.
Bullhorn's customer FAQ says it has since isolated the issue and eradicated the immediate threat. Those are the company's own statements. Bullhorn has not published an independent technical account. It has not named an attacker, and it has not said how the intruders got in. It has not said whether ransomware was involved.
The big unanswered question: was data taken?
Bullhorn says its forensic investigation is ongoing and that it has "not yet determined whether customer data was exfiltrated." The company says it will contact customers if their data turns out to be affected. It also says it will meet its legal notification obligations.
Two cautions apply:
- This is not a confirmed data breach. It is not a ruled-out one either.
- Bullhorn's FAQ says the incident affected ATS/CRM. It says there is no indication that other Bullhorn products were affected by the incident. That list includes its Salesforce-based products, Automation, SourceBreaker and VMS Sync.
An outage and a compromise are different things. Several of those products were disrupted or delayed even though Bullhorn says it has no sign they were breached.
Where services stand
The picture changed through the day on October 19. By the afternoon, Bullhorn's ATS/CRM status update said the Australia, EMEA/UK and US regions were all back online. That update also flagged login problems for customers using SSO. Those customers are told to log a support ticket.
Talent Platform was still offline. Its status entry says the network is being changed as a precaution, and Bullhorn reports no evidence of cyber activity on that platform. The last ETA I could see was 6 p.m. ET on October 19. These are point-in-time updates. They don't mean every user or every service is working normally.
Bullhorn's known-limitations page says the company took an aggressive approach to reducing risk. It removed underlying technology that supported many features and is now rebuilding them. That page lists these functions as unavailable:
- Admin system setup, covering field mappings, system settings and view layouts.
- Several Bullhorn integrations, including Analytics, Time & Expense, Onboarding 365, Talent Platform, Automation, VMS Sync and BBO.
- SSO sign-in.
- The legacy ATS/CRM SOAP APIs. Bullhorn points customers to the REST API instead. Customers whose SOAP integrations have no REST equivalent should contact support.
- Job publishing.
It also lists features that work but behave differently:
- Some non-SSO password changes can loop.
- The first list opened after login can take 30 to 60 seconds to load.
- Some mass actions and slideout panels are missing or broken.
- Pages opened from certain third-party integrations may fail.
- Automatic resume parsing straight from email may not work.
- All customers are now on a new resume-parser version, and some parsed resumes may show blank education-history entries.
What admins and integrators need to do
Non-SSO users. They are prompted to reset their password at login, using two-factor authentication. After a reset, Bullhorn says to wait one minute before logging in so the new credentials can propagate. If you land in a password-update loop, the guidance is to wait a few minutes between attempts.
SSO users. The password-reset steps are for non-SSO accounts. If SSO sign-in is failing, Bullhorn asks you to open a support ticket. Its FAQ notes that not everyone can reach the support Hub yet. In that case it gives an email address and regional phone numbers for the US, UK and Australia.
API users. Bullhorn says API passwords have been expired. The steps are:
- Log into Bullhorn ATS/CRM with the API user and its existing password.
- Create a new password when prompted.
- Complete the email verification.
If the API user has no email address on file, you must log a support case to add one.
Client secrets. Many summaries blur this point. The FAQ's "Do I need to update my Client Secret?" answer is "Not yet." Bullhorn expects to require a change later and says it will share details then. Until that happens, integrations keep working without a client-secret update. The FAQ's earlier summary line does say rotation of both is required, so watch for Bullhorn's follow-up.
Who does the work. Bullhorn will handle credential changes for integrations it hosts. If you or a third party host an integration, you must update the API credentials in your code or configuration and redeploy. Bullhorn says it is contacting Marketplace partners, Developer partners and licensed integrators directly.
Watch for phishing
Bullhorn's October 19 status update warns that threat actors may pose as Bullhorn staff by email, text or phone. They could use the incident as a pretext to ask for credentials. Bullhorn says it will never ask for your password, MFA codes or verification tokens through any channel.
Forced password resets and an outage are ideal cover for that kind of attack. Remind your recruiters to start from the official status page and not from an unsolicited message.
Business continuity and contracts
Other points from Bullhorn's FAQ:
- Data exports. These go through a dedicated support process because of the sensitivity of the situation. You request one by contacting support.
- Time records. Records that weren't posted during the outage will be reprocessed from Time & Expense when systems return.
- Resync. Data from Time & Expense, Talent Platform, Onboarding 365, Automation and VMS Sync should start syncing shortly after ATS/CRM returns. Bullhorn says that can take a few hours depending on volume.
- Service credits. Bullhorn says it will review its performance against SLAs after the incident is resolved.
- Your own notification duties. If your contracts require you to notify your own customers, Bullhorn asks you to open a support ticket. It says it is tracking those requirements.
Third parties that depend on Bullhorn were hit too. One integration vendor said write-backs to Bullhorn wouldn't land while the platform was down. A WordPress plugin vendor said its job-board sync and application-submission scripts were failing against the offline API. That vendor said most customers' application data is stored until the API returns.
Takeaways
This is a supply-chain-style incident for the staffing industry. The vendor's outage became every customer's outage, including the tools wired into it. Shutting everything down is disruptive but defensible. It also shows how little control customers have once a SaaS provider goes dark.
Practical steps for affected teams:
- Work out which Bullhorn products and integrations you actually use, and which are hosted by you, Bullhorn or a partner.
- Rotate API credentials where you host the integration, and redeploy.
- Plan for a later client-secret change.
- Check your contracts for breach-notification duties, and open the support ticket Bullhorn asks for.
- Watch the status page, not rumours.
The unresolved fact is still whether data left Bullhorn's environment. Until the forensic findings arrive, treat that as open. Don't assume the worst, and don't assume nothing happened.