Bullhorn Cyber Incident and Outage: Data Theft Unconfirmed, and a SaaS Concentration Lesson for Staffing Firms

Status (22 October 2026, 19:05 Cyprus time (UTC+3)): Monitoring. Bullhorn's status page shows "Partial System Outage". Bullhorn says it detected a cyber incident on the Bullhorn Platform on 17 October, took its systems offline to contain it, and says the incident "remains contained". Data theft is unconfirmed. Bullhorn's customer FAQ says its forensic investigation is ongoing and it has "not yet determined whether customer data was exfiltrated". Bullhorn ATS/CRM is back online with degraded features. Bullhorn says Talent Platform access "has been fully restored" (its status page showed degraded performance at 19:11 Cyprus time), while Bullhorn Back Office (BBO) is still offline and Bullhorn recommends that customers "plan for BBO to remain unavailable through the end of this week". Its latest update covers both under "the recently disclosed vulnerabilities in PHP" and "their impact on certain Bullhorn solutions". Bullhorn says "PHP’s incident is unrelated to our cyber incident". There is no CVE for this incident.

TL;DR: Bullhorn, the staffing and recruitment software company, disabled access to its platform on 17 October 2026 after detecting what it calls a cyber incident. It is working with CrowdStrike and Kroll (Bullhorn status page), has forced password resets for non-SSO users, and has expired API user passwords (Bullhorn FAQ). Services began returning on 19 October, according to The Register, and Bullhorn ran emergency login maintenance overnight into 20 October. Bullhorn ATS/CRM is back, but with many features removed or being rebuilt, and new login problems followed (Bullhorn status page). Bullhorn has not said how the attackers got in, who they are, or whether ransomware was involved. What to do now (Rescana guidance): follow Bullhorn's credential steps, watch out for fake "Bullhorn support" contacts, and make sure you can pay people and fill shifts without the platform. This is also a clear example of concentration risk: when one SaaS platform runs recruiting, onboarding, timesheets and payroll exports, an outage at that one supplier stops all of them at once.

Technical Information

Bullhorn's platform is used by staffing firms to manage candidates, jobs, placements, onboarding and time records. According to The Register, problems began on Friday 16 October, when Bullhorn reported trouble getting job postings onto Indeed. By the next morning the platform had a full outage (The Register).

Later on 17 October, Bullhorn posted on its status page: "We have detected a cyber incident on the Bullhorn Platform. We have temporarily disabled access to our systems in order to contain the activity while we investigate further." It said it was working with CrowdStrike (wording as reported by BleepingComputer and The Register). That original 17–20 October status record is no longer online: we could not find it on Bullhorn's status page, in the Wayback Machine or on archive.today (checked 22 October, 17:24–17:27 Cyprus time (UTC+3)). Bullhorn's current status updates refer back to "our Oct 17 announcement".

Bullhorn's FAQ says the incident affected Bullhorn ATS/CRM. It says there is "no indication" that other Bullhorn solutions were affected, naming its Salesforce-based products, Bullhorn Automation, Sourcebreaker and VMS Sync (Bullhorn FAQ). Bullhorn also says its team "isolated the issue and eradicated the immediate threat", and that it is "implementing enhanced protective controls".

Recovery has been uneven. Bullhorn says it "took an aggressive approach to reducing security risk and removed underlying technology that supported a significant number of features", which it is now rebuilding (Bullhorn Known System Limitations). In its 22 October update, Bullhorn separates three events (Bullhorn status page):

The 17 October cyber incident. Bullhorn says it "remains contained", that it has "detected no additional activity since our Oct 17 announcement", and that CrowdStrike and Kroll are monitoring its systems with its teams.
PHP vulnerabilities. Bullhorn says "Cybersecurity authorities have advised taking all PHP websites offline until a patch is available", and that "PHP’s incident is unrelated to our cyber incident". That part of the update is headed "Worldwide PHP Vulnerabilities – Affected Services Offline". Bullhorn revised this update at 18:24 Cyprus time (11:24 EDT); it no longer includes the earlier product lists or the statement about taking services offline. In a later update headed "Update on PHP Vulnerabilities and Service Restoration" (18:42 Cyprus time), Bullhorn refers to "the recently disclosed vulnerabilities in PHP" and "their impact on certain Bullhorn solutions". It lists Talent Platform, FastForward, Market IQ, TargetRecruit, SourceBreaker, Bond APAC Job Portal and Akyla as "Upgraded to address the vulnerabilities and fully available", and BBO as "Upgrade in progress". Bullhorn does not say which PHP vulnerabilities are involved. The US government guidance published on 21 October recommends taking PHP-based systems offline where they cannot be updated immediately, until they are patched or mitigated (CISA alert; NSA advisory). (Related reading: our PHP advisory. Bullhorn has not confirmed that its precaution concerns the same vulnerabilities.)
A database replication problem. Bullhorn says login failures came from the volume of account changes caused by the new security steps, such as MFA setup and password updates, which slowed synchronisation. Some users may still hit a password reset loop.

Timeline

All dates are 2026. Bullhorn's status page runs on US Eastern time and stamps its entries "EDT" (UTC−4). Bullhorn's update text labels some times "EST"; those labels match the page's EDT posting times, so we treated them as US Eastern daylight time (UTC−4). Times are converted to Cyprus time (UTC+3), with the source time in brackets.

16 October (Friday): Bullhorn reports problems publishing jobs to Indeed (The Register).
17 October (Saturday): System-wide outage, followed by Bullhorn's "cyber incident" notice. Access to its systems is disabled (status page as quoted by BleepingComputer and The Register; the record is no longer shown on the status page).
20 October, 05:30–08:30 (19 Oct 22:30 – 20 Oct 01:30 EDT): Emergency login maintenance on Bullhorn ATS/CRM (05:30–07:30) and BBO (06:30–08:30). Bullhorn says "User sessions will be terminated during this maintenance" (ATS/CRM record; BBO record).
20 October, 14:47 (07:47 EDT): Bullhorn says Time & Expense is "fully restored" and its data has synced to the ATS (status page).
20 October: Bullhorn warns customers that "Threat actors may pose as Bullhorn personnel via email, text, or phone calls" (as reported by The Register). The Register reports systems back online in the UK, US and Australia.
21 October, 06:19 (20 Oct 23:19 EDT): Bullhorn takes Talent Platform and BBO offline for unscheduled maintenance; its BBO components have shown major outage since this time. Bullhorn's "Unscheduled Maintenance: Talent Platform" incident record is no longer on its status page (checked 22 October, 19:09 Cyprus time); Bullhorn's 18:42 update refers to "yesterday’s maintenance".
21 October, 19:08 (12:08 ET): Bullhorn's customer FAQ is last updated.
21 October, 20:35 – 22 October, 01:10 (13:35–18:10 ET): Bullhorn says ATS/CRM users "were unable to log in". It marked login as restored at 02:37 on 22 October (19:37 EDT) (status page).
22 October, 16:00 (09:00 EDT): Bullhorn posts its three-events update and says the cyber incident "remains contained".
22 October, 17:56 (10:56 EDT): Bullhorn opens a separate incident, "Bullhorn Incident Updates - BBO", reporting a BBO "extended outage". It says users cannot enter timesheets and recommends "alternative approaches". Bullhorn Support can run payroll reports on customers' behalf (status page). (The update is labelled "10:50 AM EST 10/22/2026".)
22 October, 18:21 (11:21 EDT): Bullhorn adds an entry to its "All Products" incident: "We are continuing to investigate this issue." (status page).
22 October, 18:24 (11:24 EDT): Bullhorn revises its 09:00 EDT three-events update; it no longer includes the earlier product lists or the statement about taking services offline.
22 October, 18:42 (11:42 EDT): In "Update on PHP Vulnerabilities and Service Restoration" (labelled "11:40 AM EST 10/22/2026"), Bullhorn says "Talent Platform access has been fully restored following yesterday’s maintenance. Customers can resume normal use." It lists BBO as "Upgrade in progress" and says: "We recommend that customers plan for BBO to remain unavailable through the end of this week." Talent Platform (US, UK and CA production) moves from major outage to degraded performance on the status page.

Status page at 19:03 Cyprus time on 22 October (last updated 18:59, 11:59 EDT): Overall status "Partial System Outage". BBO (GRR, SYD and UK) shows major outage. Talent Platform (US, UK and CA production), Bullhorn ATS/CRM, Onboarding365 and Bullhorn Automation show degraded performance. Bullhorn for Salesforce, Time & Expense and Adapt show operational; the Time & Expense CERT sandbox component shows under maintenance. (Bullhorn status page).

What we know and what we don't

Confirmed by Bullhorn:

A cyber incident was detected on the Bullhorn Platform, and Bullhorn disabled access to contain it.
The incident affected Bullhorn ATS/CRM. Bullhorn has "no indication" that its Salesforce-based products, Automation, Sourcebreaker or VMS Sync were affected.
CrowdStrike and Kroll are working with Bullhorn.
Non-SSO users must reset their passwords with two-factor verification. API user passwords have been expired. Client Secret rotation will be required later, but "not yet". BBO standalone passwords "have not been reset and were not impacted".
Bullhorn's legacy ATS SOAP APIs are offline, and Bullhorn points integrators to its REST API.
Bullhorn has detected no further activity since 17 October.

Not known or not stated:

Whether any data was stolen. Bullhorn says it has not yet determined whether customer data was exfiltrated. It says it will contact customers if their data was affected and will meet its notification obligations. Until Bullhorn says otherwise, treat data theft as unconfirmed. Do not assume either way.
How the attackers got in, who they are, and whether ransomware was involved. The Register reports that Bullhorn has not said, and we have found no Bullhorn statement on these points.
Which data stores or environments the attackers reached. Bullhorn says it is "continuing to investigate the full scope".
When all removed features will return, and when BBO will be available again. Bullhorn's only guidance is to plan for BBO to remain unavailable "through the end of this week".
Any CERT or regulator statement. We found none about Bullhorn from CISA, the UK NCSC, CERT-EU or the UK ICO (checked 22 October, 19:11 Cyprus time (UTC+3)). Their recent PHP alerts are about PHP, not Bullhorn. We also found no newer statement on Bullhorn's website or blog.

Affected Product Versions

There are no software versions to patch; this is a service incident. Scope, per Bullhorn:

Affected by the cyber incident: Bullhorn ATS/CRM (Bullhorn FAQ).
Bullhorn sees "no indication" of impact on: its Salesforce-based products, Bullhorn Automation, Sourcebreaker and VMS Sync.
Affected by the PHP vulnerabilities, per Bullhorn's 18:42 update: Bullhorn lists Talent Platform, FastForward, Market IQ, TargetRecruit, SourceBreaker, Bond APAC Job Portal and Akyla as "Upgraded to address the vulnerabilities and fully available", and BBO as "Upgrade in progress". Its status page showed Talent Platform with degraded performance and BBO with major outage at 19:11 Cyprus time. Bullhorn says "PHP’s incident is unrelated to our cyber incident".

Precautionary downtime is not evidence that a product was compromised.

Workaround and Mitigation

Bullhorn's guidance

Reset passwords when prompted. Non-SSO users will be asked to reset their password with two-factor verification. Bullhorn says to wait about a minute after a reset before logging in, because new credentials take time to propagate.
Rotate API credentials. If you or a third party host an integration, log in with the API user, set a new password, complete email verification, then update and redeploy the integration. Bullhorn handles integrations it hosts itself. Marketplace and developer partners are being contacted directly.
Move off the legacy SOAP API. It is offline. Bullhorn says supported functionality is available through the REST API.
Be wary of anyone claiming to be Bullhorn. According to The Register, Bullhorn warned on 20 October that "Threat actors may pose as Bullhorn personnel via email, text, or phone calls", and said its employees would never ask customers for passwords, MFA codes or verification tokens.
Use Support for payroll and data needs. While BBO is down, Bullhorn Support can run payroll reports for you if you log a ticket. Data-extract requests go through a dedicated support process. Canvas payroll reports are available on request via IP allow-listing.
Follow the status page. Bullhorn asks customers to plan against the availability times posted at status.bullhorn.com.

Rescana guidance

Run payroll and shift fill from a fallback. If BBO or Talent Platform is still down for you, decide now how timesheets, pay runs and urgent placements will be handled for the next cycle. Record what was done outside the platform, so it can be reconciled later.
Inventory your Bullhorn integrations. List every tool that connects to Bullhorn, including job boards, VMS feeds, payroll, messaging and custom code. Confirm each one has new credentials, and check which ones relied on SOAP.
Review access logs where you can. Look for unusual logins or API use in your own connected systems around the incident window, and ask Bullhorn for any customer-specific findings.
Prepare for a possible notification. Bullhorn has not confirmed data theft. However, staffing platforms hold candidate and worker personal data, so check your own notification duties to clients, candidates and regulators now. That way you can act quickly if Bullhorn's findings change.
Brief your recruiters on phishing. Bullhorn itself has warned about impersonation. Make sure staff know to report unexpected "Bullhorn support" emails, texts and calls rather than act on them.

Concentration risk and continuity (Rescana guidance)

For many staffing firms, one platform holds the candidate database and also feeds onboarding, timesheets, payroll exports and client VMS syncs. When Bullhorn disabled access to contain the incident, that whole workflow stopped with it, and the recovery brought its own disruption: removed features, login failures under the load of mass password resets, and a separate PHP precaution that kept two more products offline. Taking systems offline and forcing credential resets are standard containment steps; the point for continuity planning is how much of your operation depends on them.

Map which business processes depend on one SaaS supplier end to end, including payroll and client billing.
Hold regular data exports you are allowed to use, and test that people can actually work from them.
Agree manual or alternative processes for time capture and pay before you need them.
Check whether your contracts with clients assume a service level that your own supplier cannot guarantee during an incident.

Indicators of Compromise

Bullhorn has not published indicators of compromise, and neither BleepingComputer nor The Register reports any. We have none to list and have not inferred any. We will add indicators here if Bullhorn or its investigators publish them.

What we will update

We will update this advisory if:

Bullhorn confirms or rules out data exfiltration, or begins customer or individual notifications.
Bullhorn states the root cause, the attacker, or whether ransomware was involved.
BBO is restored, or removed ATS/CRM features return.
Bullhorn requires Client Secret rotation.
A national CERT or data protection regulator makes a statement.

Sources

Bullhorn status page: current status; Bullhorn Incident Updates - All Products (updates of 22 Oct 2026, 09:00 EDT / 16:00 Cyprus time, revised 11:24 EDT; and 11:42 EDT / 18:42 Cyprus time); Bullhorn Incident Updates - BBO (22 Oct 2026, 10:56 EDT / 17:56 Cyprus time); Bullhorn ATS/CRM - Performance Issues (21 Oct 2026); emergency maintenance for ATS/CRM and BBO (19–20 Oct 2026); Time and Expense Service Restoration (20 Oct 2026)
Bullhorn customer documents: Bullhorn Platform Incident | Customer FAQ (last updated 21 Oct 2026, 12:08 PM ET; linked from the status page); Known System Limitations (last updated 22 Oct 2026, 11:45 AM ET)
US government PHP guidance (context for Bullhorn's PHP precaution): CISA alert (21 Oct 2026); NSA advisory (21 Oct 2026)
Press, cited only where Bullhorn's own pages no longer carry the fact: BleepingComputer (19 Oct 2026); The Register (20 Oct 2026)

Why this matters for vendor risk

When Bullhorn disabled access to contain the incident, staffing firms that run recruiting, onboarding and time capture on the platform lost all of them at once, while Bullhorn has not yet determined whether customer data was exfiltrated. That is the concentration question to put to any supplier that runs a whole workflow: what still works, and how you get your data, while it contains an incident.

Forward this to your TPRM owner: If your business or a staffing partner relies on Bullhorn, ask how payroll and placements will run while the platform is unavailable, whether your API credentials have been rotated, and how and when Bullhorn will tell you whether your data was accessed. For any core SaaS supplier, ask what you can still access and how you get your data if it takes its platform offline, which products share infrastructure or identity, and how it tests restoration, including the load from mass password resets (Rescana guidance).

Want a clear, evidence-based view of which suppliers your operations depend on and how they handle incidents like this one? Book a demo.