# Bullhorn Takes Recruiting Platform Offline After Cyberattack

- URL: https://usa-24.com/bullhorn-outage-cyberattack-staffing-platform/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-22T12:01:32.895Z
- Updated: 2026-10-22T12:01:32.903Z
- Topics: Cyberattacks, Data Breaches, Credential Theft, SaaS Security, Staffing Software

> Bullhorn took its recruiting platform offline after a cyberattack in mid-October, leaving staffing firms without applicant-tracking and billing tools while forensic work continues.

## Key takeaways

- Bullhorn took its platform offline after detecting a cyber incident, and reporting puts the full outage escalation at 08:04 EDT on October 17.
- Systems were back online in the UK, US and Australia by Monday, October 19, but single sign-on and several products still showed degraded performance.
- Non-SSO users must reset passwords, and API customers must rotate credentials, according to Bullhorn's reported guidance.
- Bullhorn has not confirmed whether customer data was taken, identified the attackers, or said ransomware was involved.
- Reports cite more than 10,000 affected customers, a figure that has not been independently verified.

The Bullhorn outage has left thousands of US staffing firms without the applicant-tracking and billing tools they use every day. Bullhorn, the cloud recruiting software vendor, took its platform offline after detecting a cyber incident. Forensic work continues, and service has come back in stages rather than all at once.

The first public sign appeared on October 16, 2026, when Bullhorn's status portal began reporting syncing problems on its CRM platform, according to [Cyber Daily](https://www.cyberdaily.au/security/14323-hacked-ai-recruitment-platform-bullhorn-responding-to-cyber-incident). The company later said the entire system was down by the morning of October 17, and Cyber Daily logged the full outage escalation by 08:04 EDT. Customers reported that API integrations and large parts of the system stayed offline or unusable into the next morning.

## What happened in the Bullhorn outage

Bullhorn brought in CrowdStrike to investigate and help restore service, according to [ThreatCluster](https://threatcluster.io/cluster/bullhorn-staffing-platform-offline-due-to-cyberattack-eadfde85). The company has not determined whether attackers took customer data, has not identified them and has not confirmed ransomware. No group has claimed responsibility in the reporting reviewed.

Bullhorn's statement, as reproduced on a [third-party WordPress plugin site](https://bullhornplugin.com/bullhorn-cyber-incident-october-2026/) that integrates with the platform, reads: “We have detected a cyber incident on the Bullhorn Platform.” The same reproduction adds: “We have temporarily disabled access to our systems in order to contain the activity while we investigate further.” Because the text comes through a secondary site, read it as reported wording rather than a verified copy from Bullhorn's own pages.

Bullhorn chose to shut access down entirely rather than keep services running during the investigation. A [summary of BleepingComputer's reporting by OffSeq Threat Radar](https://radar.offseq.com/threat/bullhorn-takes-staffing-platform-offline-to-contain-cyberattack-639b4e1314d987ba) describes the step the same way, as a takedown to contain the activity. A [timeline from Unixgaming](https://unixgaming.org/what-happened-bullhorn-s-cyber-incident-timeline/) reports that the decision drew commentary suggesting an active and serious threat. For customers, it meant losing day-to-day access with no published end date, which is the hardest part of any vendor-side shutdown.

## Is Bullhorn down, and when will service return

Service has come back in stages. [daily.dev](https://daily.dev/posts/bullhorn-sees-red-after-cyberattack-knocks-recruitment-platform-offline-gecmgikh6) reported that systems were back online in the UK, US and Australia by Monday, October 19. ThreatCluster also lists October 19 as the restoration date. Several products still showed degraded performance, including single sign-on, password resets, Talent Platform and Onboarding365.

Sources disagree on when the lockout began. The table lays out what each one says.

| Source | Date cited | What it reports |
|---|---|---|
| Cyber Daily | October 16 | Status portal flags the problem; full outage escalation by 08:04 EDT on October 17 |
| ThreatCluster | October 16 start; October 19 restoration | Platform offline; services restored October 19 |
| daily.dev | Monday, October 19 | Systems back online in the UK, US and Australia |
| Tech Jack Solutions | October 19 | Vendor roundup dating the lockout to October 19 |
| Unixgaming | October 20 | Timeline dating the lockout to October 20 |

No full-restoration timeline has been published in the sources reviewed, and the most recent check still described recovery as partial. Until Bullhorn posts a dated update, its official status page is the most reliable place to check, not a third-party link that claims to have one.

## Who is affected and what remains unknown

Press reports and vendor roundups put the number of affected customers above 10,000. That figure has not been independently verified, so treat it as an estimate rather than a count. The people most exposed are the recruiters, HR teams and staffing firms that use the platform every day for candidate pipelines, job postings and billing.

The biggest open question is whether attackers took data. Bullhorn's platform holds candidate records and payroll-related workflows, and the possible exposure includes candidate personal data and API secrets. Bullhorn says it will notify affected customers if its forensic review finds their data was compromised.

Bullhorn has also warned customers that impersonators may use the incident to phish for credentials, including by posing as Bullhorn staff by email, text or phone, according to [Cyber Daily](https://www.cyberdaily.au/security/14323-hacked-ai-recruitment-platform-bullhorn-responding-to-cyber-incident). An outage creates urgency, and urgency is what phishing depends on. Any message that rushes you to hand over a password or verification code should be treated as hostile until proven otherwise.

## What Bullhorn customers should do now

The reporting points to five practical steps.

- Reset your password if you do not use single sign-on. Bullhorn says non-SSO users must reset their passwords.
- Have your IT or integration team rotate API credentials. Bullhorn says API customers must rotate them.
- Confirm any reset or support request through official Bullhorn channels before you click a link or share a code. Ignore unsolicited email, text or phone contact.
- Check Bullhorn's official status page for restoration updates instead of third-party links.
- Audit logs for unusual API activity from your integration accounts, since exfiltration has not been ruled out. A [vendor roundup from Tech Jack Solutions](https://techjacksolutions.com/scc-vendor-rollup/bullhorn-vulnerability-rollup-2026-10-20/) makes the same recommendation.

Rotation should cover every integration, not just the obvious ones. USA 24 has reported on [LiteLLM 1.107.0 malware](https://usa-24.com/litellm-1-107-0-malware/) that stole cloud and AI keys from PyPI and Docker packages, a reminder that stolen API keys are a prized target for attackers.

## Why one vendor outage hits recruiting firms so hard

Staffing firms run their daily work through one system. A recruiter who cannot see a candidate pipeline cannot place people, and a billing team that cannot pull records cannot invoice clients. When a vendor that stores candidate records goes dark, every customer loses its working system at the same time.

The stakes are easier to see next to the ransomware campaigns that have pressed on US organizations. [SafePay](https://usa-24.com/safepay-ransomware-600-victims/) has hit more than 600 organizations, according to FBI and CISA warnings. Bullhorn has not said ransomware was involved, so the comparison is about stakes, not attribution. A breach at one platform can reach far more businesses than a breach at a single firm.

Clients and job seekers are exposed too. Clients may face delayed placements and billing, and candidates in a compromised database could become targets for follow-on phishing aimed at recruiting activity. Bullhorn carries the reputational cost, and its size will depend on what the forensic review finds.

## What to watch next

Three things will shape how this story ends. The first is the forensic review. If it finds that candidate data or API secrets left Bullhorn's systems, affected firms may face state breach-notification duties, and the 10,000 figure will matter far more than it does now.

The second is restoration. Bullhorn still needs to bring single sign-on, password resets, Talent Platform and Onboarding365 back to normal performance, and staffing firms will judge the company by how quickly those tools work again. The third is attribution. If the attackers, the intrusion path or any ransomware link come to light, customers will have a clearer picture of how exposed their own integrations were.

For now, the 10,000 figure, the start date and the scope of data exposure all remain open. Staffing firms should plan for the worse case while the facts settle, and the next official update from Bullhorn will be the first real test of how quickly it can answer them.

## Frequently asked questions

### Is Bullhorn down right now?

Bullhorn has restored its platform in stages. Daily.dev reported that systems were back online in the UK, US and Australia by Monday, October 19, but single sign-on, password resets, Talent Platform and Onboarding365 still showed degraded performance in the reporting reviewed. Check Bullhorn's official status page for the latest status, since no full-restoration timeline has been published.

### Do I need to reset my Bullhorn password?

If you do not use single sign-on, Bullhorn says you must reset your password. API customers should have their IT or integration team rotate credentials. Confirm any reset request through official Bullhorn channels, because the company has warned that impersonators may phish for credentials by email, text and phone.

### Was customer data stolen in the Bullhorn cyberattack?

Bullhorn has not determined whether attackers took customer data. The company says it will notify affected customers if its forensic review finds their data was compromised. Staffing firms should watch for that notice and audit integration logs in the meantime, since exfiltration has not been ruled out.

### Who is behind the Bullhorn hack?

Bullhorn has not identified the attackers, has not confirmed ransomware, and no group has claimed responsibility in the reporting reviewed. The company brought in CrowdStrike to investigate and help restore service. Attribution will likely depend on the outcome of the forensic review.

## Sources

1. [Hacked! AI recruitment platform Bullhorn responding to cyber incident — Cyber Daily](https://www.cyberdaily.au/security/14323-hacked-ai-recruitment-platform-bullhorn-responding-to-cyber-incident)
2. [Bullhorn sees red after cyberattack knocks recruitment platform offline — daily.dev](https://daily.dev/posts/bullhorn-sees-red-after-cyberattack-knocks-recruitment-platform-offline-gecmgikh6)
3. [Bullhorn Staffing Platform Offline Due to Cyberattack — ThreatCluster](https://threatcluster.io/cluster/bullhorn-staffing-platform-offline-due-to-cyberattack-eadfde85)
4. [Bullhorn Cyber Incident October 2026 — Bullhorn WordPress Plugin site (reproduces Bullhorn statement)](https://bullhornplugin.com/bullhorn-cyber-incident-october-2026/)
5. [Bullhorn takes staffing platform offline to contain cyberattack — OffSeq Threat Radar (summarizing BleepingComputer)](https://radar.offseq.com/threat/bullhorn-takes-staffing-platform-offline-to-contain-cyberattack-639b4e1314d987ba)
6. [Bullhorn Vulnerability Rollup (2026-10-20) — Tech Jack Solutions](https://techjacksolutions.com/scc-vendor-rollup/bullhorn-vulnerability-rollup-2026-10-20/)
7. [Bullhorn Breach Timeline: 5 Tools Down, 3 Spared [2026] — Unixgaming](https://unixgaming.org/what-happened-bullhorn-s-cyber-incident-timeline/)