Bullhorn, a cloud software company whose platform staffing and recruiting firms use to track candidates, onboard workers and run payroll, said Tuesday that its core system was back online in all regions, three days after it cut off customer access to contain a cyberattack, according to its status page. The company says it serves more than 10,000 customers worldwide, and the shutdown halted recruiting and back-office work at many of them, BleepingComputer reported. Bullhorn has not said whether customer data was stolen.
What Happened
Customers began reporting problems posting jobs Friday, BleepingComputer reported. Early Saturday, Oct. 17, Bullhorn's status page reported login errors at 5:24 a.m. Eastern time, followed by a system-wide outage notice at 8:04 a.m. At 3:28 p.m. the company said it had "detected a cyber incident on the Bullhorn Platform" and had temporarily disabled access to its systems to contain the activity while it investigated with specialists from CrowdStrike, the security firm. Late Saturday it also shut off its Talent Platform as a precaution.
The status page reported that Bullhorn was still investigating through Monday. Emergency maintenance on the applicant tracking and customer relationship management system, known as ATS/CRM, and on the Back Office product ran overnight and was completed early Tuesday.
On Tuesday morning, Bullhorn said all regions of ATS/CRM were online, that it had deployed fixes for customers who sign in through single sign-on and that Bullhorn-built customizations were still being brought back. It said some users might get stuck in a loop when updating their passwords. The status page also reported the Talent Platform restored, and a Time & Expense entry marked resolved at 7:47 a.m. said that functionality was fully restored and its data had synced to ATS/CRM. Recovery was not complete: the status page still listed degraded performance for products including Automation, Back Office, Onboarding365 and parts of ATS/CRM, and a major outage for test environments.
In the same updates, Bullhorn warned that "threat actors may pose as Bullhorn personnel via email, text, or phone calls," and said it will never ask customers for passwords, multifactor authentication codes or verification tokens.
Data Theft Not Yet Determined
Bullhorn told customers it had isolated the issue and eliminated the immediate threat, BleepingComputer reported Monday. A forensic investigation has begun, and the company said it has not yet determined whether customer data was exfiltrated, or copied out of its systems. It said it would notify affected individuals directly if a breach is confirmed. Tuesday's status updates did not address the question.
Customer guidance published by the company, as reported by BleepingComputer, says all users who do not sign in through single sign-on must reset their passwords, and API passwords used by connected applications must be rotated. Changes to client secrets, another credential that links outside software to the platform, will follow. Unposted time records will be reprocessed, and service credits will be reviewed against service-level agreements once the incident is resolved. Bullhorn has not said who was behind the attack, and no claim of responsibility has been reported.
Why It Matters
Bullhorn is an example of concentrated third-party risk. A staffing firm may run its whole business on the platform: candidate resumes and contact details, onboarding paperwork, timesheets and payroll exports. For three days, many such firms could not easily place workers, record hours or bill clients. The companies that hire through them and the job seekers whose records sit in the system are exposed as well, though they have no direct relationship with Bullhorn.
For boards and executives, the incident tests vendor contingency plans: whether critical work can continue manually for several days, whether contracts spell out notification duties and service credits, and how quickly the organization can rotate credentials that connect its own systems to a vendor's.
What to Watch
The main open question is whether the forensic investigation finds that data was taken, which would trigger notifications to individuals and possibly regulators. Watch also for full recovery of the products still listed as degraded, any claim of responsibility, and phishing attempts that exploit the disruption by impersonating Bullhorn support staff.
