If your business runs on a single SaaS platform, the Bullhorn incident is a live test of your continuity plan. Recruitment agencies using the staffing software lost access to candidate records, job applications, placements and, in some cases, the systems used to get people paid. Services are returning, but not cleanly, and the question of whether data was stolen is still open. Any team that depends on one vendor for its core workflow should use this as a prompt to review its own exposure.

What happened

According to The Register, trouble began on Friday 16 October, when Bullhorn flagged problems getting job postings onto Indeed. By the next morning the platform had a full outage. Bullhorn then said it had detected a cyber incident and had temporarily disabled access to contain the activity. It brought in CrowdStrike to help investigate and restore services. BleepingComputer also reported that the company took the platform offline to contain the attack.

The Register says Bullhorn serves more than 10,000 customers worldwide. Systems began coming back on Monday and are now online in the UK, US and Australia. As of Tuesday, though, some users still had problems with single sign-on, password resets and customizations. The status page listed degraded performance for automation tools, Talent Platform, Onboarding365 and Time & Expense.

Bullhorn has not yet determined whether attackers exfiltrated customer data, and its forensic investigation continues. It says it will contact customers if the investigation finds their information was compromised. The cause is unknown, and the company has not named the attackers or said whether ransomware was involved. It has required password resets for users who do not sign in through SSO and told customers with API integrations to rotate their credentials. It also warned that criminals may pose as Bullhorn staff by email, text or phone to extract credentials.

Why it matters

For agencies, the outage cut off the records and tools they use to place candidates and pay them. Several of the products still listed as degraded, including Time & Expense and Onboarding365, cover day-to-day staffing operations. Whether any customer lost revenue or missed payments is not yet clear.

The recovery pattern is also instructive. Analysis: the login and integration problems suggest that bringing a platform back is harder than switching it on, especially where identity systems and customer-specific configurations are involved. The resets and rotations show that customers carry cleanup work even though the incident happened at the vendor. Until the investigation ends, it is hard to say what else might need attention.

For the wider enterprise and SaaS market, this is another reminder that vendor concentration is a risk the customer carries. Agencies cannot easily pause hiring while a supplier recovers.

What it means for you

If you use Bullhorn, follow its instructions first. Reset passwords for non-SSO users, rotate API credentials in every connected tool and check which integrations hold long-lived keys. Brief your staff on phishing: Bullhorn says its employees will never ask for passwords, MFA codes or verification tokens, so treat any such request as hostile.

Prepare for a possible notification. Bullhorn says it will contact affected customers if their data was compromised, so work out now which candidate and client data sits in the platform, which jurisdictions it covers and who in your business would handle regulator and client questions if exposure is confirmed.

If you use any critical SaaS vendor, ask these questions:

  • Can we export our records on a regular schedule, and have we tested a restore elsewhere?
  • What is the manual fallback for payroll and timesheets if the platform is down for several days?
  • Does the contract commit the vendor to breach notification timelines and recovery targets?
  • Can we rotate every API key and integration secret quickly, and do we know where they all live?

Budget for the unglamorous items: offline data copies, tabletop exercises and cyber insurance terms that cover supplier outages.

What to watch

  • Whether Bullhorn confirms or rules out data exfiltration, and how it notifies affected customers.
  • Any disclosure of the cause of the intrusion or the identity of the attackers, including whether ransomware was involved.
  • Status page updates showing when SSO, password resets and the degraded products return to normal.
  • Phishing campaigns that exploit the incident by impersonating Bullhorn.

Sources