Bullhorn pulls staffing platform offline after cyberattack

Bullhorn, one of the largest vendors of staffing and recruitment software, has taken its platform offline in response to a cyberattack. The company confirmed the incident after customers reported losing access to its cloud-based applicant tracking system.

Bullhorn's software runs recruiting operations for thousands of staffing agencies worldwide, which makes the outage more than an IT inconvenience. Agencies use the platform to manage candidate databases, client records and placement workflows. With the service down, those operations grind to a halt.

The company has not yet disclosed the type of attack, the date of initial compromise, or whether data was exfiltrated. It described the shutdown as a containment measure, which usually points to a suspected or confirmed intrusion still in progress.

What does this change for staffing customers?

For now, everything. Agencies without offline exports of their candidate and client data have no access to their operational records. Recruiters cannot log placements, source candidates or run payroll-adjacent workflows that depend on the ATS.

The practical checklist for affected customers is short:

• Confirm which integrations feed Bullhorn and whether credentials stored in the platform are exposed.
• Reset API keys and service accounts connected to the ATS once access returns.
• Prepare for a potentially lengthy forensic investigation before full restoration.
• Watch for breach notification obligations if candidate personal data turns out to be compromised.

Staffing platforms hold troves of personally identifiable information on millions of job seekers. That makes them attractive targets for both ransomware operators and data brokers. Bullhorn has not said whether ransomware is involved.

Who is affected?

Bullhorn's customer base spans staffing firms of all sizes across North America and Europe, from boutique agencies to global enterprises. The outage is therefore distributed widely but thinly: many firms, each unable to work in their core system.

Third-party payroll, VMS and background-check integrations that depend on Bullhorn's APIs are also dark for the duration. Any agency running automated job posting or candidate sourcing through the platform will have those pipelines stopped.

What comes next?

Expect a staged return. Vendors in this situation typically restore service environment by environment, with forensic checks between stages. Expect answers on data exposure to arrive even later, once investigators determine what the attackers touched.

The incident is a reminder that a single SaaS dependency can idle an entire sector's back office. Firms that exported their data regularly will count the cost in hours. The rest will count it in weeks.

Bullhorn says it is working to restore service securely. It has not provided a timeline.