Bullhorn cyber incident stalls hiring and contractor pay at agencies
The recruitment software company cut access to its platform to contain the incident, leaving agencies without candidate records and some pay systems for days. Whether customer data was taken is still unknown
- Founded: 1999, headquartered in Boston
- Staff: more than 1,400 people across 14 countries, Bullhorn says
- Still listed as degraded on 20 October: Bullhorn Back Office, Talent Platform, Onboarding365 and Bullhorn Analytics
- No indication of impact, Bullhorn said: its Salesforce-based products, Sourcebreaker and VMS Sync
At an agency on a single platform, much of the contract staffing chain runs through one supplier’s software: sourcing, placement, onboarding, timesheets and the exports behind contractor pay. When that platform goes dark, the disruption reaches hiring companies and contractors who never chose the software themselves. It also makes the security of an agency’s software vendor a question for the companies buying its services, because candidate and contractor records sit on the vendor’s platform rather than the agency’s own systems.
“Our forensic investigation is ongoing, and we have not yet determined whether customer data was exfiltrated.”Bullhorn, customer FAQ on the platform incident
Bullhorn, the Boston-based recruitment software company, said it disabled access to its platform after detecting a cyber incident, and said on 20 October that all regions were back online after four days of disruption. Bullhorn says more than 10,000 companies use its software.
The trouble began on 16 October, when job postings to Indeed failed, and became a full outage the next day, as reported by The Register. Bullhorn brought in CrowdStrike to investigate and restore services, according to the same report. Services began returning on 19 October, The Register reported, and overnight emergency maintenance into 20 October ended user sessions on the ATS/CRM and back-office login clusters.
For agencies, the outage cut off candidate records, job applications, placements and, in some cases, the systems used to pay staff, The Register reported. Bullhorn said in its customer FAQ that the incident hit its ATS/CRM. Its Time and Expense service was marked fully restored early on 20 October, with data synced back to the ATS, and Bullhorn asked customers to raise a ticket for any problems with payroll exports. Time records not posted during the outage will be reprocessed, the FAQ said.
Access is coming back in stages. Bullhorn told users who do not log in through single sign-on (SSO) to reset their passwords, and expired API user passwords, so integrations hosted by customers or third parties have to be redeployed with new credentials. SSO from the ATS was restored for US customers on 20 October, with other regions still being worked on. Bullhorn also said it had removed underlying technology behind many features and was rebuilding them.
Bullhorn has not said who was behind the incident or whether ransomware was involved. Its status page warns that people may pose as Bullhorn staff by email, text or phone to ask for credentials. Service credits will be reviewed against service level agreements once the incident is resolved, according to the FAQ.
Sources
- Bullhorn, “Bullhorn Incident Updates – All Products”, status page, 20 October 2026. https://status.bullhorn.com/
- Bullhorn, “Bullhorn Platform Incident | Customer FAQ”, last updated 20 October 2026. https://docs.google.com/document/d/e/2PACX-1vT7GyVY26qMXg-HCCp5v7s-QrnGxfGaRCVUgxRVXohcwW-bQI4dx1zUqL8QmnLEnAyTtLucqkHFewuv/pub
- Bullhorn, “About Bullhorn”, company website. https://www.bullhorn.com/about/
- The Register, “Bullhorn sees red after cyberattack knocks recruitment platform offline”, Carly Page, 20 October 2026. https://www.theregister.com/security/2026/10/20/bullhorn-sees-red-after-cyberattack-knocks-recruitment-platform-offline/5304114
