--- title: Bullhorn sees red after cyberattack knocks recruitment... description: Recruitment software provider Bullhorn suffered a cyberattack that knocked its platform offline starting October 16. The company, which serves over 10,000... canonical: https://daily.dev/posts/bullhorn-sees-red-after-cyberattack-knocks-recruitment-platform-offline-gecmgikh6 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Bullhorn sees red after cyberattack knocks recruitment platform offline | daily.dev og:description: Recruitment software provider Bullhorn suffered a cyberattack that knocked its platform offline starting October 16. The company, which serves over 10,000... og:url: https://daily.dev/posts/bullhorn-sees-red-after-cyberattack-knocks-recruitment-platform-offline-gecmgikh6 og:image: https://api.daily.dev/og/posts/gECmGIkh6.png og:image:alt: Bullhorn sees red after cyberattack knocks recruitment platform offline og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Bullhorn sees red after cyberattack knocks recruitment platform offline **[The Register](https://daily.dev/sources/theregister)** · 3 min read · 0 upvotes · 0 comments ## Summary Recruitment software provider Bullhorn suffered a cyberattack that knocked its platform offline starting October 16. The company, which serves over 10,000 customers worldwide, brought in CrowdStrike to help investigate the attack and restore its services. Systems are back online in the UK, US and Australia, but single sign-on, password resets and several products including Talent Platform and Onboarding365 still report degraded performance. Bullhorn has not determined whether attackers exfiltrated customer data and hasn't identified the attackers or confirmed ransomware. It has required password resets for non-SSO users, told API customers to rotate credentials, and warned of impersonation attempts using the incident to request credentials. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What caused the Bullhorn platform outage in October 2026? Bullhorn detected a cyber incident on its platform and temporarily disabled access to contain the activity, starting with job posting issues on October 16 and escalating to a full outage by the next morning. The company brought in CrowdStrike to investigate and restore services, and systems came back online in the UK, US and Australia by Monday, though several products still showed degraded performance. _Teams relying on third-party platforms can track how vendor incidents unfold and what they signal for data risk on daily.dev._ ### Was customer data stolen in the Bullhorn cyberattack? It remains unconfirmed whether attackers exfiltrated customer data. Bullhorn's forensic investigation is ongoing and the company said it will contact affected customers if the investigation finds their information was compromised. The cause of the intrusion and whether ransomware was involved have not been disclosed. _Anyone assessing vendor breach exposure can follow updates like this as the investigation develops on daily.dev._ ### What should Bullhorn customers do to secure their accounts after the breach? Bullhorn required password resets for users who don't log in through single sign-on, and instructed customers using API integrations to rotate their credentials. The company also warned customers to watch for phishing attempts where attackers pose as Bullhorn staff via email, text, or phone to request credentials or multi-factor authentication codes. _Developers hardening account security after a vendor incident can compare response steps like these on daily.dev._ ## Similar posts on daily.dev - [CodeRED Alert Platform Shut Down Following Cyberattack](https://daily.dev/posts/codered-alert-platform-shut-down-following-cyberattack-wmjtcabch) · Dark Reading · 0 upvotes · 0 comments - [SoundCloud bounces some VPNs as it cleans up cyberattack](https://daily.dev/posts/soundcloud-bounces-some-vpns-as-it-cleans-up-cyberattack-tqpdozpnk) · The Register · 0 upvotes · 0 comments - [Attacks on US firms have moved from stealing data to stopping production](https://daily.dev/posts/attacks-on-us-firms-have-moved-from-stealing-data-to-stopping-production-eigovylbw) · The Next Web · 0 upvotes · 0 comments - [Klue hack results in data breach at several cybersecurity firms](https://daily.dev/posts/klue-hack-results-in-data-breach-at-several-cybersecurity-firms-9dzectjax) · TechCrunch · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/bullhorn-sees-red-after-cyberattack-knocks-recruitment-platform-offline-gecmgikh6) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Bullhorn sees red after cyberattack knocks recruitment platform offline","url":"https://daily.dev/posts/bullhorn-sees-red-after-cyberattack-knocks-recruitment-platform-offline-gecmgikh6","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/bullhorn-sees-red-after-cyberattack-knocks-recruitment-platform-offline-gecmgikh6"},"datePublished":"2026-10-20T20:05:31.977Z","dateModified":"2026-10-20T20:17:17.777Z","description":"Recruitment software provider Bullhorn suffered a cyberattack that knocked its platform offline starting October 16. The company, which serves over 10,000...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/16f8ce93ec8c3b6aa89354220785465b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/16f8ce93ec8c3b6aa89354220785465b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/bullhorn-sees-red-after-cyberattack-knocks-recruitment-platform-offline-gecmgikh6","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,data-breach","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"Bullhorn sees red after cyberattack knocks recruitment platform offline"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/bullhorn-sees-red-after-cyberattack-knocks-recruitment-platform-offline-gecmgikh6#faq","mainEntity":[{"@type":"Question","name":"What caused the Bullhorn platform outage in October 2026?","acceptedAnswer":{"@type":"Answer","text":"Bullhorn detected a cyber incident on its platform and temporarily disabled access to contain the activity, starting with job posting issues on October 16 and escalating to a full outage by the next morning. The company brought in CrowdStrike to investigate and restore services, and systems came back online in the UK, US and Australia by Monday, though several products still showed degraded performance. Teams relying on third-party platforms can track how vendor incidents unfold and what they signal for data risk on daily.dev."}},{"@type":"Question","name":"Was customer data stolen in the Bullhorn cyberattack?","acceptedAnswer":{"@type":"Answer","text":"It remains unconfirmed whether attackers exfiltrated customer data. Bullhorn's forensic investigation is ongoing and the company said it will contact affected customers if the investigation finds their information was compromised. The cause of the intrusion and whether ransomware was involved have not been disclosed. Anyone assessing vendor breach exposure can follow updates like this as the investigation develops on daily.dev."}},{"@type":"Question","name":"What should Bullhorn customers do to secure their accounts after the breach?","acceptedAnswer":{"@type":"Answer","text":"Bullhorn required password resets for users who don't log in through single sign-on, and instructed customers using API integrations to rotate their credentials. The company also warned customers to watch for phishing attempts where attackers pose as Bullhorn staff via email, text, or phone to request credentials or multi-factor authentication codes. Developers hardening account security after a vendor incident can compare response steps like these on daily.dev."}}]} ```