Bullhorn Cyberattack Disrupts Recruitment Services Globally
Recruitment platform Bullhorn suffered a significant cyberattack, causing a multi-day outage for over 10,000 customers worldwide and raising concerns about potential data exfiltration.
Recruitment software provider Bullhorn has been forced to shut down its platform following a cyberattack that impacted its global customer base. The outage, which began on Friday, October 16, prevented over 10,000 customers worldwide from accessing critical services, including candidate records, job applications, and payment systems.
Bullhorn initially flagged issues with job postings on October 16, but by the following morning, the platform was experiencing a full outage. The company confirmed it was dealing with a "cyber incident" and temporarily disabled access to its systems to contain the activity. Cybersecurity specialists from CrowdStrike were engaged to assist with the investigation and restoration efforts.
While systems have begun to return online in the UK, US, and Australia, the recovery has been far from seamless. As of Tuesday, October 20, Bullhorn's status page indicated that some users were still experiencing problems with single sign-on (SSO), password resets, and customizations. Several products, including automation tools, Talent Platform, Onboarding365, and Time & Expense, continued to report degraded performance.
A key concern for affected organizations is the potential exfiltration of customer data. Bullhorn has stated that a forensic investigation is ongoing and has not yet determined if attackers accessed or stole sensitive information. The company has committed to notifying affected customers if the investigation confirms data compromise.
In response to the incident, Bullhorn has implemented several security measures. Users who do not log in via SSO have been required to reset their passwords. Additionally, customers utilizing API integrations have been instructed to rotate their credentials to mitigate any potential risks.
Bullhorn has also issued a warning to its customers about potential phishing attempts. Threat actors may impersonate Bullhorn personnel via email, text, or phone calls, using the incident as a pretext to solicit credentials or other sensitive information. The company emphasized that its employees will never request passwords, multi-factor authentication codes, or verification tokens.
The exact cause of the intrusion remains unknown, and Bullhorn has not publicly identified the attackers or confirmed whether ransomware was involved in the incident. The company has not yet responded to requests for further comment.
The ongoing investigation and recovery efforts highlight the significant disruption such attacks can cause to critical business infrastructure, particularly in the fast-paced recruitment industry. The incident serves as a stark reminder of the persistent threat landscape facing software providers and their extensive customer networks.