Incident BriefingsBullhorn ATS/CRM cyber incident

Bullhorn ATS/CRM cyber incident

A cyber incident interrupted Bullhorn ATS/CRM, with feature limitations continuing after access returned.

Last modified

Summary

  • Environment: Bullhorn ATS/CRM and connected service workflows
  • Operational impact: Platform access interrupted; regional access restored with limitations
  • Financial impact: No incident cost established in the reviewed evidence
  • Record status: Developing record. Reviewed October 20, 2026; updated as evidence emerges.

What happened

Bullhorn reported a widespread outage on October 17, 2026, then confirmed a cyber incident and disabled access for containment. CrowdStrike specialists assisted the response. [3]

Impact

Talent Platform was also disabled as a precaution and later restored. That interruption does not establish it was compromised. [2]

By October 20, all ATS/CRM regions were online, with customizations and password-reset issues still being addressed. Bullhorn had not determined whether customer data was stolen. [1][3]

Timeline

  1. Outage and cyber incident confirmed

    The status notice recorded the outage at 08:04 EDT and confirmed the cyber incident at 15:28 EDT.

    [3]

  2. Regional access restored

    At 09:30 EDT, Bullhorn reported all regions online with monitoring and some limitations continuing.

    [3]

  3. Briefing updated

    This briefing was last reviewed and updated on October 20, 2026.

Threat Group & Attack Vector

The initial access path and attacker identity remain unresolved.

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific MITRE ATT&CK technique is currently mapped for this case.

Response

Bullhorn required password resets for users without single sign-on and rotation of API passwords. Its FAQ said client-secret rotation was not yet required. Removing technology for security reasons also required rebuilding features. The investigation remained open. [1]