Staffing software company Bullhorn has disabled access to its platform to contain a cyberattack that caused a system-wide outage.
The company says it has isolated the issue and eradicated the immediate threat. Currently, its team is working to restore services following thorough security reviews conducted with help from CrowdStrike specialists.
Bullhorn is an American software company specializing in cloud-based staffing and recruitment solutions. Its platform helps staffing firms manage the recruitment lifecycle, including candidate tracking, onboarding, and payroll.
The company says it serves more than 10,000 customers worldwide.
According to a status page on the incident, customers started to experience issues with job posting in the Bullhorn application on Friday.
The next day, the company said it was "experiencing a system-wide outage affecting the Bullhorn platform," and later confirmed that the issues were caused by a cyberattack.
"We have detected a cyber incident on the Bullhorn Platform. We have temporarily disabled access to our systems in order to contain the activity while we investigate further," the company said in an update.
In a FAQ page, Bullhorn says that a forensic investigation has been started and "not yet determined whether customer data was exfiltrated." Bullhorn promised to notify affected individuals directly if a data breach is confirmed.
According to the firm’s status page, most of the services are under maintainance or have degraded performance, except for Adapt, eEmpACT, and StaffSuite, which remain operational.
Major outages affect ATS/CRM, Automation, Back Office, Talent Platform, and sandbox environments.
At the time of writing, degraded performance was reported for Bullhorn for Salesforce and associated products, Onboarding365, and additional solutions including Amplify, Analytics, Messaging, SourceBreaker, VMS Sync, Data Hub, Erecruit, SalesDuel, and VMS Access.
Bullhorn has not provided any timelines for when those services will be restored. Customers should check the company’s service status page for the latest updates.
Also, the latest update mentions that all non-SSO users will be required to reset their passwords on their next login.
Also, as per the FAQ page, API passwords require rotation to protect integrations, while client-secret changes will follow later. For Bullhorn-hosted instances, this will take place automatically.
Customers can request data exports through the firm’s support to minimize business disruption.
Unposted time records will be reprocessed after restoration, and service credits will be reviewed against applicable SLAs once the incident is resolved.
BleepingComputer has contacted Bullhorn to request more information about the attack, and we will update this post with their response when received.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.