Bullhorn restores its staffing platform after a three-day cyber incident

Bullhorn restores its staffing platform after a three-day cyber incident

20 October 2026: Bullhorn, whose applicant tracking and CRM software is used by staffing and recruitment agencies, took its platform offline after detecting a cyber incident and brought every ATS and CRM region back online in the early hours of 20 October (US Eastern time). It has not yet said whether customer or candidate data was accessed.

Not yet independently verified. The password-reset and API-credential instructions are reported by BleepingComputer from Bullhorn's customer notice; the status page we read does not repeat them, and Bullhorn has not published findings on data access. We will update this when it can be confirmed, and remove this note.

How the outage unfolded

Bullhorn's status page shows login latency and errors on its ATS and CRM clusters from early on 17 October, then a system-wide outage. That afternoon it posted: "We have detected a cyber incident on the Bullhorn Platform. We have temporarily disabled access to our systems in order to contain the activity while we investigate further." It said it was working with specialists from CrowdStrike and would restore access once the activity was resolved. The Talent Platform was later disabled as a precaution.

Service came back in stages. The Talent Platform returned at midnight on 20 October, emergency maintenance for the ATS, CRM and Back Office followed, and by 03:00 all ATS and CRM regions were online, with fixes for customers signing in through single sign-on and Bullhorn-owned customisations being restored region by region. BleepingComputer reported that Bullhorn's Adapt, eEmpACT and StaffSuite products stayed up throughout.

What agencies are asked to do

The status page asks customers who had single sign-on problems to test again and open a ticket if they persist, and warns that some users may loop when updating their passwords and should wait between attempts. According to the customer notice reported by BleepingComputer, users who do not sign in through SSO must reset their passwords at the next login, API passwords must be rotated, and client-secret changes will follow, automatically for Bullhorn-hosted instances. The same report says time records that were not posted during the outage will be reprocessed, data exports are available on request, and service credits will be reviewed against the service level agreements.

The phishing risk that follows

An outage at a system that holds candidates' contact details and recruiters' logins is a gift to impersonators. Bullhorn warns that attackers may pose as its staff by email, text or phone and says it "will never ask you to share your password, Multi-Factor Authentication (MFA) codes, or verification tokens". Agencies should pass that to recruiters and to the candidates who may receive calls in Bullhorn's or the agency's name, and should check integrations that store Bullhorn API credentials, such as job boards, payroll and timesheet tools. Our applicant tracking category lists 19 products and our staffing agency software category another 19.

Related on TrustList:

• Spott raises $21 million Series A for its AI system for recruitment agencies

Sources

• Bullhorn status: Bullhorn ATS/CRM service disruption (read 2026-10-20), 20 October 2026
• BleepingComputer: Bullhorn takes staffing platform offline to contain cyberattack, 19 October 2026