What happened. Bullhorn’s status page shows login errors across its ATS/CRM clusters at 5:24 AM ET on Friday, Oct 17, then a system-wide outage by 8:04 AM ET. At 3:28 PM ET it said: “We have detected a cyber incident on the Bullhorn Platform,” that it had temporarily disabled access to contain the activity, and that it was working with specialists from CrowdStrike. Late that night it also disabled Bullhorn Talent Platform as a precaution. The day before, Oct 16, the status page logged unplanned maintenance on Bullhorn’s legacy SOAP API endpoints. Bullhorn hasn’t said whether that is related.
Where it stands (Oct 19, 2:45 to 3:15 PM ET). ATS/CRM is live again in Australia, UK/EMEA and the US. SSO customers are hitting login problems, and some users are stuck in password-update loops while backlogs clear. Talent Platform is still offline, with a 6:00 PM ET target, and Bullhorn says it has seen no evidence of cyber activity on that platform. Automation clusters, sandboxes and Back Office Next still showed major outages on the status page. Bullhorn’s known-issues page says it “removed underlying technology that supported a significant number of features” and is rebuilding them.
What isn’t known. Per Bullhorn’s FAQ as reported by BleepingComputer, the forensic investigation has not yet determined whether customer data was exfiltrated, and Bullhorn will notify affected people directly if a breach is confirmed. Attacker, entry point and number of affected customers: Undisclosed. Bullhorn is privately held, so there is no SEC 8-K to watch.
Why a security team should care. A staffing ATS holds candidate resumes, contact details, and in back-office and onboarding modules, payroll and onboarding records for contractors. It also sits in the middle of a lot of integrations: job boards, Salesforce, VMS tools, time and expense. The forced resets for every non-SSO user and the rotation of API passwords, with client secrets to follow, tell you Bullhorn is treating stored credentials as exposed. That is the same lesson as this month’s ConnectWise backup incident: a SaaS vendor’s integration credentials are a path into your data.
What we’d check. Rotate every API password and service account tied to Bullhorn now and plan for the client-secret change, unless Bullhorn hosts the instance for you, in which case it says it handles that automatically. Review what connected apps and integrations pulled from Bullhorn since Oct 16. Push SSO for anyone still on local passwords. Tell recruiters and finance that Bullhorn says it will never ask for passwords or MFA codes by email, phone or text, because attackers are expected to pose as Bullhorn support. If you are a Bullhorn customer, ask for written confirmation of whether your tenant and candidate data were in scope.