Bullhorn Takes Recruiting Platform Offline After Cyberattack

The Bullhorn outage has left thousands of US staffing firms without the applicant-tracking and billing tools they use every day. Bullhorn, the cloud recruiting software vendor, took its platform offline after detecting a cyber incident. Forensic work continues, and service has come back in stages rather than all at once.

The first public sign appeared on October 16, 2026, when Bullhorn's status portal began reporting syncing problems on its CRM platform, according to Cyber Daily. The company later said the entire system was down by the morning of October 17, and Cyber Daily logged the full outage escalation by 08:04 EDT. Customers reported that API integrations and large parts of the system stayed offline or unusable into the next morning.

What happened in the Bullhorn outage

Bullhorn brought in CrowdStrike to investigate and help restore service, according to ThreatCluster. The company has not determined whether attackers took customer data, has not identified them and has not confirmed ransomware. No group has claimed responsibility in the reporting reviewed.

Bullhorn's statement, as reproduced on a third-party WordPress plugin site that integrates with the platform, reads: “We have detected a cyber incident on the Bullhorn Platform.” The same reproduction adds: “We have temporarily disabled access to our systems in order to contain the activity while we investigate further.” Because the text comes through a secondary site, read it as reported wording rather than a verified copy from Bullhorn's own pages.

Bullhorn chose to shut access down entirely rather than keep services running during the investigation. A summary of BleepingComputer's reporting by OffSeq Threat Radar describes the step the same way, as a takedown to contain the activity. A timeline from Unixgaming reports that the decision drew commentary suggesting an active and serious threat. For customers, it meant losing day-to-day access with no published end date, which is the hardest part of any vendor-side shutdown.

Is Bullhorn down, and when will service return

Service has come back in stages. daily.dev reported that systems were back online in the UK, US and Australia by Monday, October 19. ThreatCluster also lists October 19 as the restoration date. Several products still showed degraded performance, including single sign-on, password resets, Talent Platform and Onboarding365.

Sources disagree on when the lockout began. The table lays out what each one says.

No full-restoration timeline has been published in the sources reviewed, and the most recent check still described recovery as partial. Until Bullhorn posts a dated update, its official status page is the most reliable place to check, not a third-party link that claims to have one.

Who is affected and what remains unknown

Press reports and vendor roundups put the number of affected customers above 10,000. That figure has not been independently verified, so treat it as an estimate rather than a count. The people most exposed are the recruiters, HR teams and staffing firms that use the platform every day for candidate pipelines, job postings and billing.

The biggest open question is whether attackers took data. Bullhorn's platform holds candidate records and payroll-related workflows, and the possible exposure includes candidate personal data and API secrets. Bullhorn says it will notify affected customers if its forensic review finds their data was compromised.

Bullhorn has also warned customers that impersonators may use the incident to phish for credentials, including by posing as Bullhorn staff by email, text or phone, according to Cyber Daily. An outage creates urgency, and urgency is what phishing depends on. Any message that rushes you to hand over a password or verification code should be treated as hostile until proven otherwise.

What Bullhorn customers should do now

The reporting points to five practical steps.

• Reset your password if you do not use single sign-on. Bullhorn says non-SSO users must reset their passwords.
• Have your IT or integration team rotate API credentials. Bullhorn says API customers must rotate them.
• Confirm any reset or support request through official Bullhorn channels before you click a link or share a code. Ignore unsolicited email, text or phone contact.
• Check Bullhorn's official status page for restoration updates instead of third-party links.
• Audit logs for unusual API activity from your integration accounts, since exfiltration has not been ruled out. A vendor roundup from Tech Jack Solutions makes the same recommendation.

Rotation should cover every integration, not just the obvious ones. USA 24 has reported on LiteLLM 1.107.0 malware that stole cloud and AI keys from PyPI and Docker packages, a reminder that stolen API keys are a prized target for attackers.

Why one vendor outage hits recruiting firms so hard

Staffing firms run their daily work through one system. A recruiter who cannot see a candidate pipeline cannot place people, and a billing team that cannot pull records cannot invoice clients. When a vendor that stores candidate records goes dark, every customer loses its working system at the same time.

The stakes are easier to see next to the ransomware campaigns that have pressed on US organizations. SafePay has hit more than 600 organizations, according to FBI and CISA warnings. Bullhorn has not said ransomware was involved, so the comparison is about stakes, not attribution. A breach at one platform can reach far more businesses than a breach at a single firm.

Clients and job seekers are exposed too. Clients may face delayed placements and billing, and candidates in a compromised database could become targets for follow-on phishing aimed at recruiting activity. Bullhorn carries the reputational cost, and its size will depend on what the forensic review finds.

What to watch next

Three things will shape how this story ends. The first is the forensic review. If it finds that candidate data or API secrets left Bullhorn's systems, affected firms may face state breach-notification duties, and the 10,000 figure will matter far more than it does now.

The second is restoration. Bullhorn still needs to bring single sign-on, password resets, Talent Platform and Onboarding365 back to normal performance, and staffing firms will judge the company by how quickly those tools work again. The third is attribution. If the attackers, the intrusion path or any ransomware link come to light, customers will have a clearer picture of how exposed their own integrations were.

For now, the 10,000 figure, the start date and the scope of data exposure all remain open. Staffing firms should plan for the worse case while the facts settle, and the next official update from Bullhorn will be the first real test of how quickly it can answer them.