Human resources software company Bullhorn has suspended access to its platform to contain a cyberattack that led to a system-wide outage.
The company says it has isolated the issue and eliminated the immediate threat. The team is currently working to restore services following thorough security checks conducted with the help of CrowdStrike specialists.
Bullhorn is an American software company specializing in cloud-based human resources and recruiting solutions. Its platform helps staffing firms manage the recruiting lifecycle, including candidate tracking, onboarding and payroll.
The company says it serves more than 10,000 customers worldwide.
According to a status page about the incident, customers have been experiencing problems with the Bullhorn job posting since Friday.
The next day, the company said there was “a system-wide outage on the Bullhorn platform,” later confirming that the problems were caused by a cyberattack.
“We have discovered a cyber incident on the Bullhorn platform. We have temporarily suspended access to our systems to contain the activity while we continue to investigate,” the said the company said in an update.
On an FAQ page, Bullhorn says a forensic investigation has been initiated and “has not yet determined whether customer data was exfiltrated.” Bullhorn promised to notify affected individuals directly if a data breach is confirmed.
According to the company Status pageMost services are under maintenance or have reduced performance, with the exception of Adapt, eEmpACT and StaffSuite, which remain operational.
Major outages affect ATS/CRM, automation, back office, talent platform and sandbox environments.
At the time of writing, a Bullhorn performance degradation has been reported for Salesforce and related products, Onboarding365, and additional solutions such as Amplify, Analytics, Messaging, SourceBreaker, VMS Sync, Data Hub, Erecruit, SalesDuel, and VMS Access.
Bullhorn did not provide any timelines for restoring those services. Customers should check the company’s service status page for the latest updates.
Also, the latest update mentions that all non-SSO users will need to reset their passwords the next time they log in.
Also according to the FAQ pageAPI passwords will need to be rotated to protect integrations, while client secret changes will come later. For Bullhorn hosted instances, this happens automatically.
Customers can request data exports through company support to minimize business disruption.
Unbooked time records will be reprocessed upon recovery and service credits will be verified against applicable SLAs once the incident is resolved.
BleepingComputer has contacted Bullhorn and asked for more information about the attack. We will update this post with the response once we receive it.
