Bullhorn Cyberattack: Why the Password-Reset Week Is a Phishing Window for Staffing Firms and the Businesses That Hire Through Them

If you run a staffing or recruiting firm on Bullhorn, or you hire temps and contractors through an agency that does, this week brings a familiar risk: a vendor outage, forced password resets and a flood of "support" messages. Bullhorn's recruiting software (ATS/CRM) went dark over the weekend after a cyberattack. Access is back, but parts of the platform are still limited, and Bullhorn says it hasn't yet determined whether customer data was taken. Live updates are on the Bullhorn status page.

What Bullhorn has confirmed

The incident: On Saturday, October 17, at 3:28 PM ET, Bullhorn posted on its status page: "We have detected a cyber incident on the Bullhorn Platform. We have temporarily disabled access to our systems in order to contain the activity while we investigate further." Job-posting problems had started the day before, according to BleepingComputer and The Register.
Who uses it: Bullhorn's software is built for staffing and recruiting firms. BleepingComputer and The Register report that the company serves more than 10,000 customers worldwide.
Who is investigating: Bullhorn's status page cited security reviews with help from CrowdStrike specialists, as BleepingComputer reported. Bullhorn CISO Owen Meehan told Staffing Industry Analysts the company is "working with leading cybersecurity specialists from CrowdStrike and Kroll."
Restoration: Access began returning October 19. On October 20, Bullhorn said all regions were online, and Meehan named Australia, Europe and the US. As of the status page's 1:15 PM ET update that day, 10 of 21 production ATS/CRM clusters still showed "Degraded Performance," as did Bullhorn Automation, Back Office, Talent Platform and Onboarding365.
Still offline: Bullhorn's known-limitations page (last updated October 20 at 1:30 PM ET) lists job publishing, the legacy SOAP APIs, admin system setup, Canvas and My Dashboard as unavailable, along with ATS/CRM integrations for Bullhorn Analytics, Time & Expense, Onboarding365, Talent Platform, Automation and Back Office. Admins can edit existing users again but can't add new ones yet.
Resets: Users who don't sign in with single sign-on (SSO) must reset their passwords at their next login. API passwords must be rotated, and Bullhorn says client-secret changes will follow later. Bullhorn updates the integrations it hosts. Customers and third parties must update their own.
Scam warning: Bullhorn's status page says: "Threat actors may pose as Bullhorn personnel via email, text, or phone calls, using the incident as a pretext to request credentials or sensitive information." Bullhorn says it will never ask for passwords, MFA codes or verification tokens.

What isn't known

Bullhorn's customer FAQ says its forensic investigation is ongoing and it has "not yet determined whether customer data was exfiltrated." It says it will contact customers if their data turns out to be affected. No attacker has been named, and no group has claimed the attack, according to Cyber Daily. The Register notes that Bullhorn hasn't said whether ransomware was involved, and Bullhorn has given no date for full restoration. Treat any claim of stolen candidate data or a named ransomware gang as unconfirmed until Bullhorn or investigators say so.

The takeaway

Staffing systems hold some of the most useful data a scammer can get: names, contact details, résumés, placement and pay records, and client contacts. Whether or not anything left Bullhorn's systems, the reset period is a phishing window. Recruiters are expecting password emails. Candidates are expecting calls about jobs. Clients are expecting updates. An attacker only has to sound like any one of those.

What to do this week

Reset only through official channels. Start from your usual Bullhorn sign-in page, not a link in a message. Bullhorn's reset guide says the reset email comes from noreply@bullhorn.com and should arrive only after you try to sign in.
Rotate API passwords, then other connected credentials. If your firm or a contractor runs your own integrations, update the API credentials they use, and watch for Bullhorn's client-secret notice. Also review any shared keys for job boards, payroll or onboarding tools connected to Bullhorn.
Review connected apps. List every integration, plug-in and user account tied to Bullhorn. Remove any you don't recognize or no longer use. Move anything that relied on the legacy SOAP API to the supported REST API.
Treat "Bullhorn support" as suspect. Brief your recruiters and front desk, and warn candidates and clients too. Check any call, text or email that claims to be from Bullhorn by contacting Bullhorn through a channel you already know. Never share an MFA code.
Keep a manual workaround. While job publishing is down, post priority openings directly on job boards and track applicants in a simple spreadsheet that only your team can open.
Ask the data question now. If you hire through a staffing partner, ask whether they use Bullhorn, what candidate and client data sits in it, and who would notify affected people if exposure is confirmed. Staffing firms should check their own contracts and state breach-notification duties now, not later.

How Brotherly Technology can help

Brotherly Technology helps small businesses in Rome, Northwest Georgia and beyond handle vendor incidents. We rotate credentials, audit connected apps, run phishing-awareness briefings and plan workarounds that keep you running. If you want help working through this checklist, give us a call.