Summary

• Bullhorn detected a cyber incident on 17 October and temporarily disabled platform access to contain the activity, with CrowdStrike assisting its investigation.
• On 20 October, Bullhorn reported that all regions were online and Time and Expense had been restored, although some sign-on, customisation and integration issues continued.
• The company warned customers about social engineering attempts exploiting the incident; the public record has not established whether customer data was taken.

Recruitment software provider Bullhorn has restored regional access to its platform following a cyber incident that interrupted staffing agencies’ ability to manage candidates, vacancies and associated administrative work.

In updates published on 20 October, the company said all regions were online and its teams were monitoring service recovery. Some customers continued to encounter difficulties involving single sign-on, customisations and integrations, while separate notices confirmed the restoration of Time and Expense functionality and progress on other affected services.

Bullhorn detected the cyber incident on 17 October and temporarily disabled access to its systems as part of its containment response. The company engaged cybersecurity specialists from CrowdStrike to assist with the investigation and restoration process.

The incident affected a platform used by recruitment and staffing businesses for applicant tracking, customer relationship management, placement administration and related operations. Its consequences extended beyond the ability to log in because many customers also depend on connections between Bullhorn and other business applications.

Containment restricted access to recruitment systems

Bullhorn initially reported errors and difficulties logging into its applicant tracking and customer relationship management platform on 17 October. Its subsequent status updates described a system-wide outage affecting customers across several operating environments.

Later that day, the company confirmed that it had detected a security incident and had deliberately disabled system access while investigating the activity.

For staffing agencies, the restriction affected software used to manage information about job vacancies, candidate applications, employers and placements. These records support routine recruitment work, including identifying suitable candidates, maintaining contact histories and progressing applications through hiring processes.

Recruitment businesses also use connected applications to advertise roles, receive applications, manage onboarding documents and administer timesheets. Access to those functions can depend on the availability of the central recruitment platform and the interfaces through which information moves between systems.

The outage consequently created work across more than one application. Employees could be unable to retrieve candidate records or update placement information, while automated exchanges with external services might fail or remain pending.

The effects depended on the software each customer used and the way its integrations were configured. Some agencies could continue parts of their operations through other systems, while activities requiring access to Bullhorn’s underlying records were disrupted.

Restricting platform availability can be an important containment measure during a security investigation. The company must establish which systems are safe to restore and whether returning access could interfere with the investigation or allow malicious activity to continue.

That process involves technical and operational decisions, particularly where customers depend on the platform for business-critical work.

Regional access returns while integrations recover

By 20 October, Bullhorn had reported substantial progress restoring its services. The company’s status page said all regions were online, although several components remained subject to monitoring or degraded performance notices.

Single sign-on was one area requiring additional attention. The technology allows users to authenticate through an identity service and access connected applications without entering separate credentials for every system.

Bullhorn said access from its applicant tracking platform to other Bullhorn and external applications had been restored for US customers. Work concerning other regions continued, with users experiencing persistent authentication problems asked to test their access and contact support.

The company also restored administrators’ ability to edit users and set passwords manually within the application. Some customers were warned that repeated password changes could produce an authentication loop, requiring additional time before another attempt.

Customisations maintained by Bullhorn were being returned to service across regions. These functions can form part of customers’ established workflows, so their availability affects whether users can complete familiar tasks even after the main system becomes accessible.

Separate updates confirmed that Bullhorn Time and Expense had been restored, with data synchronised back into the applicant tracking system. Customers experiencing continuing problems with payroll exports or payroll integrations were directed to raise support requests.

Bullhorn also resolved a position synchronisation problem involving its vendor management system service and the applicant tracking platform.

These updates establish progress across identifiable applications rather than a single uniform moment at which every customer process resumed normal operation.

Staffing agencies must reconcile interrupted work

Recruitment workflows often involve several systems handling different stages of the same transaction. A vacancy may originate in a customer’s record, be distributed to external job boards and generate applications through a candidate portal.

Information then moves through shortlisting, interviews, placement administration and, where relevant, onboarding and timesheet processing.

When the central application is unavailable, external services may continue collecting information without successfully transferring it. Depending on the integration, transactions can remain in queues, be retried automatically or require manual intervention.

Restoring access therefore creates a reconciliation task. Administrators need to identify whether pending applications, records and updates have reached their intended destination and whether any activity was duplicated during recovery.

Payroll-related systems require particular care because incomplete or inconsistent timesheet information can affect the accuracy and timing of payments to temporary workers.

Bullhorn’s confirmation that Time and Expense data had synchronised back into the applicant tracking platform addresses an important part of that workflow. Customers experiencing export or integration problems still need to resolve those issues within their own operating arrangements.

Manual processes used during the disruption may also require reconciliation. Employees can record essential information outside the unavailable application, but those records must subsequently be entered accurately without overwriting newer information or creating duplicate entries.

Recovery procedures need to account for the order in which connected systems resume operation. An integration may depend on another service being available, while restarting automated processes prematurely can generate additional errors.

Security investigation continues alongside restoration

Bullhorn has confirmed that CrowdStrike is assisting with the security response. The company has not publicly established the method used by the attacker, the identity of those responsible or whether customer information was taken.

Those questions are separate from the availability of the platform. Restoring services can allow customers to resume work while forensic investigation and decisions about any further security measures continue.

The company has also warned customers about social engineering attempts that could exploit awareness of the incident.

Attackers may impersonate Bullhorn employees through email, telephone calls or text messages, using claims about account recovery or service restoration to request credentials and other sensitive information.

Bullhorn has reminded customers that its personnel will not ask them to disclose passwords, multi-factor authentication codes or verification tokens through those channels.

Such warnings are relevant during recovery because users may be expecting unfamiliar instructions concerning login problems, application access or account changes.

Organisations therefore need to direct staff towards authenticated support channels and make clear how legitimate operational guidance will be communicated.

Administrators may also need to review the credentials and permissions used by service accounts connecting Bullhorn with other business applications. Changes made during containment or restoration can affect those connections independently of ordinary user access.

Customer assurance follows technical restoration

Bullhorn’s recovery provides staffing agencies with an opportunity to assess how dependent their operations are on individual software suppliers and the connections between their applications.

Business continuity arrangements may need to cover temporary recruitment administration, the preservation of candidate information and procedures for restarting payroll-related processes when a central platform becomes unavailable.

Supplier assurance is another consideration. Recruitment businesses handle significant quantities of personal information, and their data protection responsibilities can include assessing incidents affecting companies processing information on their behalf.

Whether a particular organisation must make a regulatory notification depends on the facts established about the incident, the information involved and the legal requirements applying to it. The confirmed service interruption does not, by itself, establish that a personal data breach occurred.

Customers will need sufficiently detailed information from Bullhorn to determine whether their own records, integrations or processing arrangements were affected beyond the disruption already acknowledged.

As of its 20 October updates, Bullhorn had restored access across its regions, resolved several identified service problems and continued work on outstanding issues.

The immediate priorities are stable authentication, completed customisation and integration recovery, and accurate reconciliation of activity interrupted during the shutdown. Further findings from the security investigation will establish whether additional action is required to address the underlying incident.