Bullhorn Outage Disrupts an Industry

Bullhorn, the ATS/CRM platform used by much of the staffing industry, took its systems offline on October 17, 2026 after detecting a cyber incident. Since then, service has come back slowly, region by region. As of October 20, Bullhorn says all regions are online, but it has not yet determined whether any user data was taken.

Background

Bullhorn serves more than 10,000 customers worldwide. Problems first surfaced on October 16, when Bullhorn reported job postings failing to sync to Indeed. On the morning of October 17 it posted a system-wide outage, and that afternoon it disclosed a cyber incident, said it had disabled access to its systems to contain the activity, and said it was working with CrowdStrike to investigate and remedy the situation.

The shutdown reached ATS/CRM, Automation, Back Office, Talent Platform and sandbox environments, while Onboarding365, Amplify, Analytics, Messaging and other products ran in a degraded state.

Australia and EMEA/UK were back online by early morning Eastern time on October 19. Bullhorn’s October 20 update reports all regions online, with recent fixes for SSO login problems that customers are asked to retest. Time & Expense has been fully restored, and its data synced to ATS, and customers with payroll export or integration problems are directed to open a support ticket.

Non-SSO users must reset their passwords using two-factor authentication. API user passwords have been expired and must be rotated, and customers who host their own integrations, or use a third-party host, must update credentials before those integrations will work again.

What Bullhorn is Saying

Bullhorn’s customer FAQ, last updated October 18, states:

“...we have not yet determined whether customer data was exfiltrated.”

The FAQ says Bullhorn will give customers any notices required under applicable data privacy laws and its contracts and that it will review its performance against SLAs and address service credits once the incident is resolved.

Its October 20 status update adds:

“Threat actors may pose as Bullhorn personnel via email, text, or phone calls”

Analysis and Guidance

It is not yet known whether any candidate, employee, or client data was accessed or taken. The cause of the intrusion remains unknown, and Bullhorn has not publicly identified the attackers or confirmed whether ransomware was involved. No threat actor has yet claimed responsibility. The breach notification points below apply only if Bullhorn’s investigation finds that personal data was affected.

If that happens, most staffing firms would be the owner of the affected data, not Bullhorn. Under most U.S. state breach notification statutes, a vendor that maintains personal information on behalf of another business must notify that business. That business then carries the duty to notify affected individuals. Firms holding UK or EU data would face the same split under the GDPR. A processor must notify the controller without undue delay (Art. 33(2)). The controller’s 72-hour deadline to notify the regulator (Art. 33(1)) runs from when it becomes aware of a personal data breach.

Some MSAs define “security incident” to include suspected incidents and incidents at the staffing firm’s vendors. Under language like that, a notice obligation could arise from the incident itself, before Bullhorn’s forensic work is finished. Other MSAs require notice only after a confirmed breach. Firms should read their own language rather than assume either way.