Bullhorn Disables Staffing Platform to Contain Cyberattack

Staffing software provider Bullhorn has temporarily disabled access to its platform after a cyberattack caused a system-wide outage.

The company says it has isolated the issue and eradicated the immediate threat. Bullhorn is now working to restore services following a comprehensive security review conducted with assistance from CrowdStrike specialists.

Bullhorn platform outage follows cyberattack

Bullhorn is an American software company that provides cloud-based staffing and recruitment solutions. Its platform helps staffing agencies manage the recruitment lifecycle, including candidate tracking, onboarding, and payroll.

The company says it provides services to 10,000 customers worldwide.

According to Bullhorn’s incident status page, customers first reported problems posting job listings on the platform on Friday.

The following day, Bullhorn announced that it was “experiencing a system-wide outage affecting the Bullhorn platform.” The company later confirmed that the outage was caused by a cyberattack.

“We have detected a cyber incident on the Bullhorn platform. We have temporarily disabled access to the system to contain the activity while we conduct further investigation,” the company said in an update.

Customer data compromise has not been confirmed

Bullhorn said on its FAQ page that a forensic investigation is underway, but “it is not yet known whether customer data was compromised.” The company said it will directly notify affected individuals if a data breach is confirmed.

According to the Bullhorn status page, most services are under maintenance or experiencing degraded performance. Adapt, eEmpACT, and StaffSuite are expected to continue working.

The outage affects major parts of Bullhorn’s platform, including ATS/CRM, automation, back-office, talent, and sandbox environments.

As of this writing, performance degradation has also been reported for Bullhorn for Salesforce and related products, Onboarding365, Amplify, Analytics, Messaging, SourceBreaker, VMS Sync, Data Hub, Erecruit, SalesDuel, and VMS Access.

Bullhorn requires password and API credential changes

Bullhorn has not provided a timeline for restoring the affected services. Customers should monitor the company’s service status page for the latest updates.

The latest update states that all non-SSO users must reset their passwords the next time they log in.

According to the company’s FAQ page, API passwords must be rotated to secure integrations, while client secrets will be changed later. For instances hosted by Bullhorn, these changes will occur automatically.

Data exports and service credits

Customers can contact Bullhorn support to request a data export and minimize business disruption.

Unposted time records will be reprocessed after services are restored. Bullhorn also said that service credits will be considered against applicable service-level agreements once the incident is resolved.

BleepingComputer has contacted Bullhorn for more information about the cyberattack. This article will be updated if the company responds.

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.

The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report