- Bullhorn took its staffing platform offline after a cyberattack. Customers own the resets, integrations and explanations, while the vendor sets the recovery pace.
- BleepingComputer reports that users who do not sign in through SSO must reset passwords, and that API passwords are being rotated (automatically for Bullhorn-hosted instances).
- Check now whether you could run without the platform, which accounts skip SSO, which integrations hold API credentials, and what your SLA covers.
When a software vendor is attacked, the outage is only the first bill. The second arrives inside your own systems. Depending on how your staff sign in and where your instance is hosted, it can mean passwords, keys and connections that Bullhorn says must change. The Bullhorn incident shows how that second bill gets split.
What happened at Bullhorn
Bullhorn is a US company that sells cloud software to staffing and recruitment firms. Customers use it to track candidates, onboard workers and run payroll. By the company's own count, its customer base exceeds 10,000 organisations worldwide.
BleepingComputer reports that Bullhorn deliberately shut off access to its systems while it dealt with a cyberattack. According to the status page, customers first had trouble posting jobs on Friday. The next day Bullhorn reported a system-wide outage. It later confirmed a cyberattack. In its words: "We have detected a cyber incident on the Bullhorn Platform."
Bullhorn describes the immediate danger as contained and removed. It is restoring services after security reviews with CrowdStrike specialists. BleepingComputer reports no restoration timeline.
Bullhorn's own status page listed three unresolved incidents: ATS/CRM Canvas issues, a Talent Platform disruption and an ATS/CRM disruption. BleepingComputer reports that most services were in maintenance or running degraded. Adapt, eEmpACT and StaffSuite stayed operational.
How the cleanup reaches the customer
The most useful details are the recovery steps, not the outage. Bullhorn says every user who does not sign in through single sign-on (SSO) must reset their password at next login. SSO means staff log in through their employer's own identity system instead of a separate vendor password.
Bullhorn's FAQ also says API passwords need rotation to protect integrations. An API password lets one piece of software, such as a payroll or job-board tool, talk to Bullhorn without a person present. Changes to client secrets, a similar kind of credential, will follow later.
For Bullhorn-hosted instances, the rotation happens automatically. The report does not say what customers with other setups must do themselves.
The sources do not say why these resets were ordered. Changing credentials is a common step when attackers may have had access to them. Nothing in the report says they did.
What is still unknown
Bullhorn says a forensic investigation has started. It has "not yet determined whether customer data was exfiltrated." It promises to notify affected individuals directly if a breach is confirmed. The sources do not say how the attackers got in.
BleepingComputer says it has asked Bullhorn for more detail. Until that answer arrives, customers are planning around gaps.
The idea: you outsource the system, not the consequences
The order of events is telling. Job posting failed first, then the whole platform went down. Bullhorn says unposted time records will be reprocessed after restoration. The work has happened, but the paperwork waits on the vendor.
This is what concentration looks like in practice. When one platform holds hiring, onboarding and payroll, one incident touches all three. The vendor sets the recovery pace. The customer still owns the password resets, the integrations and the explanations to its own clients and staff.
Bullhorn has offered some help. Customers can ask support for data exports to soften the disruption. The company says it will weigh service credits against customers' service-level agreements (SLAs) after the incident closes.
Questions to put to your team
First, can you work without the platform for a week? Ask what an export would contain, and how fast someone could request one. Bullhorn offers exports on request, but only if you know to ask.
Second, which of your staff log in with their own vendor passwords rather than SSO? Those accounts carry the reset burden in this incident. Third, list every integration that uses an API password or client secret. Know who owns each one and how long a change takes.
Fourth, read your SLA now. Bullhorn says credits will be reviewed against it. Check what it covers and what it leaves out before you need it.
A vendor's security reviews can restore its servers. They cannot restore your own continuity. That part of the plan has to be written before the outage, by you.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Bullhorn.
