{
  "id": 15747325,
  "title": "Bullhorn sees red after cyberattack knocks recruitment platform offline",
  "url": "https://urgent.news/2026/10/20/bullhorn-sees-red-after-cyberattack-knocks-recruitment-platform",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-20T12:15:00.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/10/20/bullhorn-sees-red-after-cyberattack-knocks-recruitment-platform-offline/5304114"
  },
  "original_language": "en",
  "account": "Recruitment software provider Bullhorn recently fell victim to a cyberattack, resulting in the shutdown of its platform while the company investigated. Bullhorn, which serves over 10,000 customers globally, reported that its systems were restored in the UK, the US, and Australia. However, users continued to face challenges with single sign-on (SSO), password resets, and customizations, with some products still experiencing degraded performance. The disruption began on Friday, October 16, when the company noticed issues posting job listings to Indeed. By the following morning, the platform encountered a complete outage, and Bullhorn confirmed later that day that it was grappling with a more severe issue than an ordinary technical glitch.\n\nThe company disclosed a cyber incident and temporarily disabled access to its systems to contain the activity and investigate further. CrowdStrike, a cybersecurity firm, assisted Bullhorn in the investigation and restoration of its services. Recruitment agencies utilizing Bullhorn faced significant setbacks, losing access to candidate records, job applications, placements, and payment systems in some instances. Services gradually returned on Monday, but the recovery process has been far from smooth. As of Tuesday morning, Bullhorn’s status page still indicated degraded performance across several products, including its automation tools, Talent Platform, Onboarding365, and Time & Expense.\n\nAlthough Bullhorn is making progress in reinstating customer access, it has not yet determined if the attackers stole any data. The company has launched a forensic investigation and has not yet confirmed whether the attackers exfiltrated customer information. In its customer FAQ, Bullhorn stated that they will notify affected customers if their data is found to be compromised. The company also issued a warning to potential scammers, urging them to avoid posing as Bullhorn representatives via email, text, or phone calls to request credentials or sensitive information. Employees would never ask customers for passwords, multi-factor authentication codes, or verification tokens.\n\nBullhorn has not publicly identified the attackers or confirmed if ransomware was involved, and the cause of the intrusion remains unknown. The company has not responded to inquiries from The Register at the time of publication. While the outage may be nearing its end, Bullhorn’s investigation into the extent of the attackers' actions is far from complete.",
  "summary": "Staffing software giant calls in CrowdStrike as customers face login headaches and questions remain over possible data theft",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}