Breaches

Bullhorn cyber attack knocks UK recruiters’ platform offline

Bullhorn shut its ATS/CRM after a cyber incident. Service is back in the UK, but it cannot yet say whether candidate data was taken.

Illustration of server racks with a warning overlay representing the Bullhorn recruitment platform cyber attack

Bullhorn, the cloud recruitment platform behind thousands of staffing agencies, shut down its core system over the weekend after detecting a cyber incident. Service is now returning in the UK, but the company has not yet established whether candidate or client data left its network.

What happened

The first sign of trouble was small. On Friday 16 October, Bullhorn’s status page reported that job postings were failing to sync with Indeed. Early on Saturday 17 October, Bullhorn’s status page flagged login errors and latency, and by 08:04 US Eastern time the company was describing a system-wide outage of its ATS/CRM, the applicant tracking and client relationship platform that recruitment firms use to run their day-to-day business.

At 15:28 Eastern time the same day, Bullhorn confirmed the cause. It said it had “detected a cyber incident on the Bullhorn Platform”, had disabled access to contain the activity and had brought in incident responders from CrowdStrike. Later that evening it also took Bullhorn Time & Expense and its Talent Platform offline as a precaution, which stopped placements and timesheets syncing between systems and left some approvers unable to sign off hours.

Early on Monday 19 October, the Australian and EMEA/UK regions came back online, followed by the US. Bullhorn, which claims a customer base of over 10,000 firms, has published a customer FAQ stating that its forensic investigation is continuing and that it has “not yet determined whether customer data was exfiltrated”. It has promised to contact affected customers if that changes. At the time of writing no criminal group has claimed the attack, and Bullhorn has not said how the intruders got in.

The technical picture

Bullhorn has said little about the attack itself, but its recovery steps tell defenders a good deal. Every non-SSO user is being forced to reset their password at next login, with two-factor verification. API user passwords have been expired outright, so any integration hosted by a customer or a third party will stop working until someone logs in as the API user, sets a new password, completes email verification and redeploys the integration with the new credential. Bullhorn has also told customers that OAuth client secrets will have to be rotated at a later date, although it is not yet enforcing this.

The FAQ admits the company was deliberately heavy-handed in cutting risk and stripped out underlying technology behind many features, which it is now rebuilding. Legacy SOAP APIs remain unavailable and some SSO customers struggled to log in after restoration. Bullhorn says it has no indication that its Salesforce-based products, Bullhorn Automation, Sourcebreaker or VMS Sync were affected by the incident itself, although several connected services were disrupted while the core platform was offline.

Reading between the lines, a vendor does not expire every API credential, plan a client secret rotation and strip out whole components of its stack for a minor fault. Those are the moves of a provider that cannot yet rule out credential exposure. That is not proof that data was stolen, and Bullhorn has been careful not to say so. It does mean customers should behave as though their Bullhorn credentials may have been seen.

Timeline of the Bullhorn cyber incident from sync errors on 16 October to restoration on 19 October 2026

Why it matters for UK organisations

Bullhorn serves UK recruitment agencies, and its restored service list explicitly names an EMEA/UK region. For agencies, the ATS is not a back-office tool: it holds candidate records, CVs, client contacts, placement histories and, through Time & Expense, the timesheets that drive pay for temporary and contract workers. An outage running into Monday can delay placements and worker pay.

The data protection position is the bigger issue. Under UK GDPR, the agency is normally the controller of candidate data and Bullhorn acts as its processor. The processor must tell controllers without undue delay once it becomes aware of a breach, but the decision on whether to report to the ICO within 72 hours sits with each agency, based on what it knows. “Not yet determined” is an uncomfortable place to be. Agencies should be recording their assessment now rather than waiting for a final forensic report.

There is a supply chain angle too. Agencies place staff into NHS trusts, councils, banks and critical national infrastructure, and their client contact lists and placement records are exactly the sort of material social engineers use, and Bullhorn has warned that attackers may pose as its personnel by email, text or phone, using the incident as cover to ask for credentials or sensitive information.

Expert view

In my experience, the most dangerous phase of a SaaS incident is not the outage, it is the week after restoration. Teams are rushing to fix integrations, helpdesks are flooded, and a convincing “Bullhorn support” call asking an administrator to read out a verification code will land far more often than it should. Bullhorn’s guidance is plain: its staff will not request passwords, one-time codes or tokens. That message needs to reach every recruiter, not just IT.

The forced API password expiry is also a useful audit. When we test recruitment and HR environments, we routinely find integration credentials hard-coded in job board connectors, website application forms and automation scripts. Many agencies will discover this week that they do not know where all their Bullhorn credentials live.

Credit where due: Bullhorn confirmed an attack within hours, named its responders, published a detailed FAQ and has avoided premature claims that no data was touched. That candour helps customers more than early reassurance.

What to do now

  1. Warn staff about impersonation. Remind every user that genuine Bullhorn staff will not request credentials or codes, and route any “Bullhorn” contact through a known support channel. This maps to the Cyber Essentials user access control theme and basic security awareness.
  2. Reset and rotate. Make sure all non-SSO users complete the forced reset, reset every API user password, and update self-hosted and third-party integrations. Prepare now for the client secret rotation Bullhorn has signalled.
  3. Inventory integrations. List every system that holds a Bullhorn credential, including website forms, job boards and scripts. Remove any you no longer use and keep credentials in a secrets manager, not in code.
  4. Check data consistency. Applications submitted during the outage may not have reached the ATS. Reconcile web forms and job board responses, and confirm timesheets were reprocessed correctly so contractors are paid on time.
  5. Document your UK GDPR assessment. Record what Bullhorn has told you, when, and your reasoning on ICO notification. Review your processor contract for breach notification duties and log any contractual notice requirements with Bullhorn support, as its FAQ invites.
  6. Review SSO and logging. Where you use SSO, check identity provider logs for unusual Bullhorn sign-ins since 16 October and confirm MFA is enforced for all users.
  7. Test your continuity plan. Ask how your agency would operate if a single SaaS platform disappeared for three days again.

Bottom line

Bullhorn’s platform is largely back, but the investigation is not finished and the question of whether data was taken remains open. UK recruitment agencies should treat their Bullhorn credentials as potentially exposed, rotate them, brief staff against impersonation and document their data protection decisions now, rather than waiting for the forensic report to make those decisions for them.

Sources

Related Posts