--- title: "Bullhorn ATS/CRM cyber incident" description: "Bullhorn disabled ATS/CRM access after a cyber incident; regional access returned while data-exfiltration findings remained unresolved." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-10-20" canonical_url: "https://www.ally.security/incidents/bullhorn-ats-crm-cyber-incident-2026" markdown_url: "https://www.ally.security/incidents/bullhorn-ats-crm-cyber-incident-2026.md" stix_url: "https://www.ally.security/incidents/bullhorn-ats-crm-cyber-incident-2026/stix.json" --- # Bullhorn ATS/CRM cyber incident A cyber incident interrupted Bullhorn ATS/CRM, with feature limitations continuing after access returned. Last modified Oct 20, 2026 · 3 sources ## Summary - **Environment:** Bullhorn ATS/CRM and connected service workflows - **Operational impact:** Platform access interrupted; regional access restored with limitations - **Financial impact:** No incident cost established in the reviewed evidence ## What happened [Bullhorn](https://www.bullhorn.com/) reported a widespread outage on October 17, 2026, then confirmed a cyber incident and disabled access for containment. [CrowdStrike](https://www.crowdstrike.com/) specialists assisted the response. [3](#source-3) ## Impact Talent Platform was also disabled as a precaution and later restored. That interruption does not establish it was compromised. [2](#source-2) By October 20, all ATS/CRM regions were online, with customizations and password-reset issues still being addressed. Bullhorn had not determined whether customer data was stolen. [1](#source-1) [3](#source-3) ## Timeline ### October 17, 2026 — Outage and cyber incident confirmed The [status notice](https://status.bullhorn.com/incidents/6ylmf0t08t5j) recorded the outage at 08:04 EDT and confirmed the cyber incident at 15:28 EDT. [3](#source-3) ### October 20, 2026 — Regional access restored At 09:30 EDT, Bullhorn reported all regions online with monitoring and some limitations continuing. [3](#source-3) ### October 20, 2026 — Briefing updated This briefing was last reviewed and updated on October 20, 2026. ## Threat Group & Attack Vector The initial access path and attacker identity remain unresolved. ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response Bullhorn required password resets for users without single sign-on and rotation of API passwords. Its [FAQ](https://docs.google.com/document/d/e/2PACX-1vT7GyVY26qMXg-HCCp5v7s-QrnGxfGaRCVUgxRVXohcwW-bQI4dx1zUqL8QmnLEnAyTtLucqkHFewuv/pub) said client-secret rotation was not yet required. Removing technology for security reasons also required rebuilding features. The investigation remained open. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Bullhorn Platform Incident — Customer FAQ official · Bullhorn ### Bullhorn Talent Platform — Service Disruption official · Bullhorn · Oct 18, 2026 ### Bullhorn ATS/CRM — Service Disruption official · Bullhorn · Oct 17, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** Bullhorn ATS/CRM cyber incident: Bullhorn required non-SSO password resets with two-factor authentication and rotation of API user passwords; its specific Client Secret answer said that rotation was not yet required. 2. **Resulted In · 100% confidence · current** Bullhorn ATS/CRM cyber incident: Talent Platform access was disabled as a precaution on October 17 and reported restored with monitoring on October 20. 3. **Resulted In · 100% confidence · current** Bullhorn ATS/CRM cyber incident: Bullhorn had not determined whether customer data was exfiltrated as of its October 20 08:50 ET FAQ. 4. **Resulted In · 100% confidence · current** Bullhorn ATS/CRM cyber incident: The FAQ identified ATS/CRM as affected and said it had no indication other Bullhorn solutions were affected by the cyber event; this is separate from precautionary service outages. 5. **Resulted In · 100% confidence · current** Bullhorn ATS/CRM cyber incident: Bullhorn said removing underlying technology for security reasons required rebuilding features, causing functionality changes and limitations. 6. **Occurred At · 100% confidence · current** Outage and cyber incident confirmed: 2026-10-17 7. **Resulted In · 100% confidence · current** Bullhorn ATS/CRM cyber incident: Bullhorn reported a system-wide outage at 08:04 EDT on October 17, after earlier login errors. 8. **Resulted In · 100% confidence · current** Bullhorn ATS/CRM cyber incident: At 09:30 EDT on October 20, Bullhorn reported all ATS/CRM regions online, with monitoring ongoing; some customizations and password-reset issues remained. 9. **Resulted In · 100% confidence · current** Bullhorn ATS/CRM cyber incident: Regional access restored with remaining limitations 10. **Affected Organization · 100% confidence · current** Bullhorn ATS/CRM cyber incident: Bullhorn 11. **Resulted In · 100% confidence · current** Bullhorn ATS/CRM cyber incident: Bullhorn confirmed a cyber incident and temporarily disabled access to contain activity, with CrowdStrike specialists assisting. 12. **Resulted In · 100% confidence · current** Bullhorn ATS/CRM cyber incident: Outage and cyber incident confirmed 13. **Disclosed At · 100% confidence · current** Bullhorn ATS/CRM cyber incident: 2026-10-17 14. **Occurred At · 100% confidence · current** Regional access restored with remaining limitations: 2026-10-20