Bullhorn now counts itself among the technology giants hit by an intrusion. The staffing software vendor took its platform down while investigators went to work, and it has brought in CrowdStrike to help.
That platform serves more than 10,000 customers around the world. Access has since been restored in the United States, Britain and Australia, though restoration and usability are two different things.
Back online, still broken
A Tuesday status notice admitted that single sign-on, password resets and customizations were still giving some people trouble, and that automation tools, Talent Platform, Onboarding365 and Time & Expense remained sluggish. The first symptom appeared Friday, October 16, when job postings stopped reaching Indeed. Within a day the whole system was dark, and a later statement confirmed a genuine security event rather than routine downtime.
“We have detected a cyber incident on the Bullhorn Platform,” the company said, explaining that access was cut off to contain the activity. Recovery started Monday, but recruiters spent that first day without candidate records, applications or placements, and some could not reach the machinery that pays contractors.
The open question
Nobody at Bullhorn has yet said whether data left the network. Its customer FAQ describes a forensic review still in progress, with no conclusion on exfiltration, no attribution and no word on ransomware. Affected clients will be contacted if the review shows exposure.
Meanwhile non-SSO accounts must pick new passwords, API users have been told to rotate credentials, and the firm is warning that crooks are impersonating staff by phone call and text to fish for passwords and MFA codes. Bullhorn says it never requests those. It did not answer The Register’s queries before publication.
