Cloud-based staffing and recruitment solutions provider **Bullhorn** has confirmed a cyberattack on its platform, leading to a temporary shutdown of services to contain the threat. The incident, first reported by customers experiencing issues with job postings on Friday, escalated to a system-wide outage by Saturday. **Bullhorn**, which serves over 10,000 customers globally, stated it has isolated the issue and eradicated the immediate threat. Recovery efforts are now underway, supported by cybersecurity firm **CrowdStrike**.  ### Incident Details and Impact The company's status page initially noted a "system-wide outage affecting the Bullhorn platform" before confirming the cyber incident. In an update, **Bullhorn** stated, "We have detected a cyber incident on the Bullhorn Platform. We have temporarily disabled access to our systems in order to contain the activity while we investigate further." A forensic investigation has been initiated to determine if customer data was exfiltrated. **Bullhorn** has committed to directly notifying affected individuals if a data breach is confirmed. ### Service Disruptions and Recovery Steps Most **Bullhorn** services, including ATS/CRM, Automation, Back Office, and Talent Platform, are currently under maintenance or experiencing degraded performance. However, some services like Adapt, eEmpACT, and StaffSuite remain operational. Degraded performance has also been reported for **Bullhorn** for Salesforce, Onboarding365, Amplify, Analytics, Messaging, SourceBreaker, VMS Sync, Data Hub, Erecruit, SalesDuel, and VMS Access. As a precautionary measure, all non-SSO users will be required to reset their passwords upon their next login. Additionally, API passwords require rotation to protect integrations, with client-secret changes to follow. For **Bullhorn**-hosted instances, this will be managed automatically. Customers are advised to monitor **Bullhorn**'s service status page for the latest updates. To minimize business disruption, the company is allowing customers to request data exports through its support channels. Unposted time records will be reprocessed post-restoration, and service credits will be reviewed against applicable SLAs once the incident is fully resolved.