Bullhorn, a US company whose cloud applicant-tracking and CRM software is used by staffing and recruitment firms (more than 10,000 customers worldwide, according to the company), disabled access to its platform after detecting what it calls a cyber incident on the Bullhorn Platform. Its status page shows login errors across all ATS/CRM clusters, including the Australian clusters CLS61 and CLS62, from 05:24 EDT on 17 October (5:24 pm Perth), a system-wide outage by 08:04 EDT, and at 15:28 EDT (3:28 am Perth, 18 October) the statement that a cyber incident had been detected, access had been temporarily disabled to contain the activity, and CrowdStrike specialists were assisting.

Bullhorn brought its Australian, EMEA/UK and US regions back online on 19 October; at 16:54 EDT (4:54 am Perth, 20 October) it said all regions were online and that it had fixed sign-in problems for SSO customers.

In its customer FAQ (last updated 19 October, 5:15 pm ET) Bullhorn says it has isolated the issue and removed the immediate threat, that the incident affected Bullhorn ATS/CRM, and that there is no indication other Bullhorn products, including its Salesforce-based products, Bullhorn Automation, SourceBreaker and VMS Sync, were affected. Its forensic investigation is ongoing and it has not yet determined whether customer data was exfiltrated; it says it will contact affected customers and meet notification obligations if data was affected.

Non-SSO users must reset their password at their next login (with two-factor verification), API user passwords have been expired and must be changed, and client secrets will have to be rotated later. Bullhorn Back Office passwords were not reset and were not affected. To reduce risk Bullhorn removed the underlying technology behind a significant number of features, so some functions remain offline or changed while they are rebuilt, including the legacy ATS/CRM SOAP APIs, several integrations and job publishing.

Bullhorn warns that criminals may pose as Bullhorn staff by email, text or phone using the incident as a pretext, and says it will never ask for passwords, MFA codes or verification tokens.

It has not said what kind of attack it was or who was behind it.

UPDATE (23 Oct 2026; Bullhorn status page): In an update posted at 6:28 pm US Eastern on 22 October (6:28 am Perth, 23 October), headed 'Update on PHP Vulnerabilities and Service Restoration', Bullhorn said Talent Platform access had been fully restored and listed Talent Platform, FastForward, Market IQ, TargetRecruit, SourceBreaker, Bond APAC Job Portal and Akyla as 'Upgraded to address the vulnerabilities and fully available', with the Back Office (BBO) 'Upgrade in progress'.

It said: 'We recommend that customers plan for BBO to remain unavailable through the end of this week.' In a separate 'Status Update: Bullhorn Back Office' posted at 6:30 pm US Eastern on 22 October, Bullhorn said: 'Whilst we are in this extended outage, we will not be able to provide user access to enter time sheets and we recommend using alternative approaches', adding that Bullhorn Support can run payroll reports for customers.

On 23 October (Perth) the status page listed every ATS/CRM cluster, including the Australian clusters CLS61 and CLS62, as 'Degraded Performance' and Bullhorn Back Office, including BBO SYD, as 'Major Outage'.

Bullhorn's 22 October update links the Back Office work to the PHP vulnerabilities; it does not say whether it is connected to the 17 October incident. Primary: Bullhorn status page and customer FAQ; wire: BleepingComputer (19 Oct).

UPDATE (24 Oct 2026; Bullhorn status page): in an update headed '[6:30 PM EST 10/23/2026]' (incident first posted at 3:01 pm US Eastern on 23 October, 3:01 am Perth 24 October) Bullhorn said 'Access to BBO has been restored', that time entry with existing credentials is available and password changes are not required.

In a separate update with the same heading it said 'All products are available, but some features are still impacted', that Canvas in the ATS is not yet available and that some users are still having login issues. On 24 October (Perth) the status page listed BBO SYD as 'Degraded Performance' and the Australian ATS/CRM clusters CLS61 and CLS62 as 'Under Maintenance'.