Bullhorn sees red after cyberattack knocks recruitment platform offline

Bullhorn is the latest tech giant finding itself on the wrong end of a cyberattack, forcing the recruitment software provider to shut down its platform while it investigates.

The US-based company, which serves more than 10,000 customers worldwide, says its systems are now back online in the UK, US, and Australia.

Unfortunately for customers hoping to get back to work, online doesn't necessarily mean working.

In its latest status update, published on Tuesday , Bullhorn confirmed that some users were still struggling with single sign-on (SSO), password resets, and customizations, while several products continued to report degraded performance.

Things started going sideways on Friday, October 16, when Bullhorn flagged problems getting job postings onto Indeed.

By the following morning, the platform was suffering a full-blown outage, and Bullhorn confirmed later that day that it was dealing with something rather more serious than a technical hiccup.

"We have detected a cyber incident on the Bullhorn Platform.

We have temporarily disabled access to our systems in order to contain the activity while we investigate further," the company said, noting that it had roped in cybersecurity specialists from CrowdStrike to help investigate the attack and restore its services.

For recruitment agencies using Bullhorn, the outage meant losing access to candidate records, job applications, placements and, in some cases, the systems used to get people paid.

Services began returning on Monday, but recovery has been anything but seamless.

As of Tuesday morning, Bullhorn's status page still listed degraded performance across several products, including its automation tools, Talent Platform, Onboarding365 and Time & Expense.

While Bullhorn is making progress getting customers back into their accounts, it has yet to answer arguably the bigger question: whether the attackers stole anything.

In its customer FAQ , it said a forensic investigation is ongoing, and has not yet determined whether attackers exfiltrated customer data.

Bullhorn says it will contact affected customers if the investigation finds their information was compromised, and it also warned people to watch out for opportunistic crooks looking to exploit the chaos.