Bullhorn sees red after cyberattack knocks recruitment platform offline

Bullhorn, a leading recruitment software provider, is grappling with the aftermath of a cyberattack that has taken its platform offline. The US-based company, which caters to over 10,000 customers across the globe, announced that its services were down following an incident on Friday, October 16. The attack forced Bullhorn to disable access to its systems in order to contain the activity while they investigated the matter.

Despite the platform being back online in the UK, US, and Australia, issues persisted for some users. Problems with single sign-on (SSO), password resets, and customizations continued to plague certain users. Moreover, several products reported degraded performance, casting a shadow over the recovery process. As of Tuesday morning, Bullhorn's status page still depicted degraded performance across multiple products, including automation tools, Talent Platform, Onboarding365, and Time & Expense.

The cyberattack's impact was severe, disrupting access to crucial data such as candidate records, job applications, placements, and payment systems. For recruitment agencies relying on Bullhorn, the outage meant losing out on valuable resources. The company has been collaborating with cybersecurity specialists from CrowdStrike to investigate the incident and restore services. However, the true extent of the breach remains unclear as Bullhorn has not determined whether attackers stole customer data.

In response to the crisis, Bullhorn issued a warning to customers, urging them to exercise caution against opportunistic cybercriminals who may attempt to exploit the situation. Threat actors could impersonate Bullhorn personnel via email, text, or phone calls, potentially requesting sensitive information such as credentials, multi-factor authentication codes, or verification tokens. The company emphasized that its employees would never ask for such information.

To mitigate the risk, Bullhorn prompted users who haven't logged in through SSO to reset their passwords. Customers utilizing API integrations were instructed to rotate their credentials. The cause of the intrusion remains unknown, and Bullhorn has refrained from publicly identifying the attackers or confirming the involvement of ransomware.

The company has yet to respond to inquiries regarding the incident. While the outage may be drawing to a close, Bullhorn's investigation into the attackers' actions is far from complete.