Analysis
Bullhorn, a U.S.-based recruitment software provider used by more than 10,000 agencies worldwide, took its platform offline after detecting a cyberattack, according to The Register. The company first flagged problems posting job listings to Indeed on Friday, October 16, suffered a full platform outage the morning of Saturday, October 17, and confirmed a cyber incident later that day.
What happened, and what's still broken
Bullhorn said in a statement that it "detected a cyber incident on the Bullhorn Platform" and took systems offline to contain the activity, bringing in CrowdStrike to investigate and help restore service. Services began returning in the UK, US and Australia on Monday, October 19, but as of Tuesday morning the company's own status page still showed degraded performance for its automation tools, Talent Platform, Onboarding365 and Time & Expense products. Customers using single sign-on have faced ongoing login and password-reset problems, and Bullhorn has told customers using API integrations to rotate their credentials.
“Customers using single sign-on have faced ongoing login and password-reset problems, and Bullhorn has told customers using API integrations to rotate their credentials.”
The unanswered questions
Four days after detection, Bullhorn has not disclosed the cause of the intrusion, whether ransomware was involved, or whether attacker activity extended to customer data. The company says a forensic investigation is ongoing and it will notify affected customers if the probe finds data was compromised. In the meantime, Bullhorn has warned customers that "threat actors may pose as Bullhorn personnel via email, text, or phone calls," and said its own staff will never ask for passwords, MFA codes or verification tokens, a standard but necessary warning given how often breach aftermath becomes a secondary phishing opportunity.
Why a recruiting-software outage matters this much
Recruitment agencies that rely on Bullhorn lost access to candidate records, job applications, placement data and, for some customers, the systems used to actually pay contract workers, meaning the outage wasn't just an inconvenience but a direct disruption to agencies' ability to run payroll and fulfill client contracts. That makes Bullhorn a useful case study in concentration risk: a huge share of the recruiting industry depends on a single vendor's infrastructure, and a four-day-plus outage at that vendor becomes everyone's outage simultaneously.
What to watch
Bullhorn did not respond to The Register's questions before publication, and the company has not said when full functionality will return or confirmed whether this was ransomware. The next disclosure to watch for is whether Bullhorn's forensic investigation turns up evidence of stolen candidate or client data, which would convert this from an availability incident into a data-breach notification problem with a very different cost and liability profile.
