Bullhorn, the recruiting platform used by more than 10,000 staffing firms, shut off access on October 17 after a cyberattack and brought in CrowdStrike. Services are mostly back, but customers have had to reset passwords and fix broken integrations, and Bullhorn is warning that attackers may pose as its staff to ask for credentials. It still hasn’t said how attackers got in or whether customer data was taken.
More info can be found here: Bullhorn sees red after cyberattack knocks recruitment platform offline
Jason Brown, Director of Customer Advisory Counter Fraud Lead, iCOUNTER
“Bullhorn runs recruiting, onboarding and time and expense for more than 10,000 staffing customers. When it disabled access on October 17, staffing firms around the world lost the systems they use to fill jobs and, in some cases, to get people paid. The days after an incident like this are exactly when fraudsters move in. Customers across the platform are resetting passwords and repairing integrations at the same time, and that hands criminals a ready-made script. Bullhorn is already warning that attackers may pose as its staff to ask for passwords and MFA codes. Staffing firms should treat any call, text or email about their Bullhorn account as suspect until they verify it through a channel they already trust, and they should scrutinize any request to change payroll or direct deposit details while things settle. Customers still don’t know whether their data was taken, and they won’t until Bullhorn’s forensics are done. Companies need their own view of the threats aimed at the third parties they depend on, so they aren’t waiting on someone else’s notice to find out they’re exposed.”
I for one would like to find out how the threat actors got in. It will likely give useful clues that will stop the next attack from happening. Also, I for one would like to know if data was swiped or not which will indicate if customers should expect attacks.
Related
This entry was posted on October 20, 2026 at 2:33 pm and is filed under Commentary with tags Hacked. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Bullhorn took its staffing platform offline for 10,000+ customers after a cyberattack and still can’t say whether data was taken
Bullhorn, the recruiting platform used by more than 10,000 staffing firms, shut off access on October 17 after a cyberattack and brought in CrowdStrike. Services are mostly back, but customers have had to reset passwords and fix broken integrations, and Bullhorn is warning that attackers may pose as its staff to ask for credentials. It still hasn’t said how attackers got in or whether customer data was taken.
More info can be found here: Bullhorn sees red after cyberattack knocks recruitment platform offline
Jason Brown, Director of Customer Advisory Counter Fraud Lead, iCOUNTER
“Bullhorn runs recruiting, onboarding and time and expense for more than 10,000 staffing customers. When it disabled access on October 17, staffing firms around the world lost the systems they use to fill jobs and, in some cases, to get people paid. The days after an incident like this are exactly when fraudsters move in. Customers across the platform are resetting passwords and repairing integrations at the same time, and that hands criminals a ready-made script. Bullhorn is already warning that attackers may pose as its staff to ask for passwords and MFA codes. Staffing firms should treat any call, text or email about their Bullhorn account as suspect until they verify it through a channel they already trust, and they should scrutinize any request to change payroll or direct deposit details while things settle. Customers still don’t know whether their data was taken, and they won’t until Bullhorn’s forensics are done. Companies need their own view of the threats aimed at the third parties they depend on, so they aren’t waiting on someone else’s notice to find out they’re exposed.”
I for one would like to find out how the threat actors got in. It will likely give useful clues that will stop the next attack from happening. Also, I for one would like to know if data was swiped or not which will indicate if customers should expect attacks.
Share this:
Like this:
Related
This entry was posted on October 20, 2026 at 2:33 pm and is filed under Commentary with tags Hacked. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.