Bullhorn (staffing and recruitment software) takes its ATS/CRM platform offline worldwide, including its Australian data centre, after detecting a cyber incident on 17 Oct; all regions back online 19 Oct with forced password resets and API password rotation; Bullhorn has not yet determined whether customer data was taken
Bullhorn, a US company whose cloud applicant-tracking and CRM software is used by staffing and recruitment firms (more than 10,000 customers worldwide, according to the company), disabled access to its platform after detecting what it calls a cyber incident on the Bullhorn Platform. Its status page shows login errors across all ATS/CRM clusters, including the Australian clusters CLS61 and CLS62, from 05:24 EDT on 17 October (5:24 pm Perth), a system-wide outage by 08:04 EDT, and at 15:28 EDT (3:28 am Perth, 18 October) the statement that a cyber incident had been detected, access had been temporarily disabled to contain the activity, and CrowdStrike specialists were assisting. Bullhorn brought its Australian, EMEA/UK and US regions back online on 19 October; at 16:54 EDT (4:54 am Perth, 20 October) it said all regions were online and that it had fixed sign-in problems for SSO customers. In its customer FAQ (last updated 19 October, 5:15 pm ET) Bullhorn says it has isolated the issue and removed the immediate threat, that the incident affected Bullhorn ATS/CRM, and that there is no indication other Bullhorn products, including its Salesforce-based products, Bullhorn Automation, SourceBreaker and VMS Sync, were affected. Its forensic investigation is ongoing and it has not yet determined whether customer data was exfiltrated; it says it will contact affected customers and meet notification obligations if data was affected. Non-SSO users must reset their password at their next login (with two-factor verification), API user passwords have been expired and must be changed, and client secrets will have to be rotated later. Bullhorn Back Office passwords were not reset and were not affected. To reduce risk Bullhorn removed the underlying technology behind a significant number of features, so some functions remain offline or changed while they are rebuilt, including the legacy ATS/CRM SOAP APIs, several integrations and job publishing. Bullhorn warns that criminals may pose as Bullhorn staff by email, text or phone using the incident as a pretext, and says it will never ask for passwords, MFA codes or verification tokens. It has not said what kind of attack it was or who was behind it. Primary: Bullhorn status page and customer FAQ; wire: BleepingComputer (19 Oct).
- Product
- Bullhorn ATS/CRM (cloud applicant tracking and CRM for staffing and recruitment firms), all regions including Australia
- Versions
- n/a — SaaS incident (detected 17 Oct 2026; regions restored 19 Oct 2026)
- Exploited in Australia?
- unknown
- Patch to
- Bullhorn customers: reset non-SSO passwords when prompted; change API user passwords and redeploy any self-hosted or third-party integrations with the new credentials; get ready for the later client-secret rotation; review Bullhorn-connected integrations and audit logs for unusual exports since mid-October. Warn recruiters and candidates about phishing and phone scams that use the outage as a pretext (Bullhorn will never ask for passwords or MFA codes). Australian recruitment firms should document the incident now so they can quickly assess whether it is an eligible data breach under the Privacy Act's Notifiable Data Breaches scheme if Bullhorn confirms data was taken. Practitioner page: /knowledge/ndb-clock.
Primary: Bullhorn Status — Bullhorn ATS/CRM service disruption (17–19 Oct 2026; cyber incident confirmed 17 Oct 15:28 EDT) · Vendor: Bullhorn Knowledge Base — Known system limitations after the incident (updated 19 Oct 2026, 3:00 pm ET); customer FAQ linked from the status page (updated 19 Oct, 5:15 pm ET) · BleepingComputer — Bullhorn takes staffing platform offline to contain cyberattack (19 Oct 2026)