Bullhorn posted on its status page on Oct 17 (3:29 PM ET): "We have detected a cyber incident on the Bullhorn Platform". It said it had temporarily disabled access to contain the activity and is working with CrowdStrike. Bullhorn's ATS/CRM, Talent Platform, back-office and automation products were taken offline. By 4:54 PM ET Oct 19 Bullhorn said all ATS/CRM regions (AUS, EMEA/UK, US) were back online, and at 6:00 PM ET it said Talent Platform service had been restored. Per BleepingComputer's reading of Bullhorn's FAQ, a forensic investigation hasn't yet determined whether customer data was taken. Non-SSO users must reset passwords on next login, and API passwords need rotating, with client-secret changes to follow.

Do now (Bullhorn customers): rotate API passwords and integration secrets, and review integration and API logs from about Oct 16 on. Watch for social engineering: Bullhorn warns that attackers may pose as Bullhorn staff by email, text or phone, and that it never asks for passwords, MFA codes or tokens. No actor or ransomware claim confirmed.