Bullhorn Cyberattack Disrupted Staffing Operations for More Than 10,000 Customers

Bullhorn temporarily shut down access to its staffing platform after detecting unauthorized activity, disrupting recruiting and workforce operations for a customer base of more than 10,000 staffing firms.

The company disabled systems on October 17 as a containment measure and brought in CrowdStrike to support the investigation. Services have since been restored for many customers, although organizations have reported password resets, authentication problems and broken integrations during recovery.

Bullhorn's platform supports recruiting, onboarding, timekeeping and expense processes. An extended outage can therefore affect more than hiring activity, including workflows connected to payroll and worker payments.

The company has also warned customers that criminals may impersonate Bullhorn personnel and ask for passwords or multifactor authentication codes. That secondary fraud risk commonly rises during incident recovery, when users expect support messages and changes to account access.

"The days after an incident like this are exactly when fraudsters move in," said Jason Brown, director of customer advisory and counter fraud lead at iCOUNTER. "Staffing firms should treat any call, text or email about their Bullhorn account as suspect until they verify it through a channel they already trust."

Bullhorn has not publicly established how the attackers gained access or whether customer data was taken. Those questions remain subject to the continuing investigation.

Customers should verify support requests through known contact channels, review administrative changes, rotate credentials and scrutinize requests involving payroll or direct-deposit information. Security teams should also monitor connected applications as integrations return to service.