Bullhorn takes staffing platform offline to contain a cyber incident

On 17 October 2026, Bullhorn — the Boston-based maker of cloud software for staffing and recruitment agencies, serving more than 10,000 customers worldwide — confirmed that it had detected "a cyber incident on the Bullhorn Platform." The company temporarily disabled access to its systems to contain the activity, triggering a system-wide outage that began after customers first reported problems posting jobs. Bullhorn said it had isolated the issue and eradicated the immediate threat, and that it was conducting a security review alongside specialists from CrowdStrike.

The disruption hit a broad swathe of Bullhorn's portfolio. Its ATS/CRM, Automation, Back Office, Talent Platform, and sandbox environments saw major outages, while products including Bullhorn for Salesforce, Onboarding365, Amplify, Analytics, and Messaging ran in a degraded state. Core services were largely restored by 19 October, though some single sign-on users continued to report login problems.

Data and recovery

As of its disclosure, Bullhorn said it had not determined whether any customer data was exfiltrated and promised to notify affected individuals directly if a breach is confirmed. The company required non-SSO users to reset their passwords at next login and expired API passwords, obliging customers to rotate integration credentials; for Bullhorn-hosted instances, those changes were applied automatically. It did not disclose a restoration timeline, the attack vector, the threat actor, or the number of customers affected.

Why it matters

Bullhorn sits at the centre of the staffing industry's operations, holding candidate records, onboarding data, and payroll information for thousands of agencies. An outage of its core applications halts day-to-day placement and billing work across its customer base, and the forced credential resets create a window in which attackers may attempt to impersonate the vendor — a risk the company flagged by urging customers to reset passwords only through Bullhorn's own login flow and to treat unexpected reset emails with caution.