Bullhorn takes staffing platform offline after cyberattack
Staffing software company Bullhorn shut down access to its platform over the weekend after a cyberattack. It says it has contained the threat and is working with CrowdStrike to restore service. It has not yet determined whether any customer data was stolen in the attack.
Bullhorn, a company whose cloud software helps staffing firms recruit and pay workers, took its platform offline over the weekend to contain a cyberattack, BleepingComputer and Cyber Daily reported.
Customers first reported problems on Oct. 16, Cyber Daily reported. By the morning of Oct. 17, the company said it was "experiencing a system-wide outage affecting the Bullhorn platform." Later that day, it confirmed a cyber incident.
"We have detected a cyber incident on the Bullhorn Platform. We have temporarily disabled access to our systems in order to contain the activity while we investigate further," the company said. It is working with specialists from the security firm CrowdStrike.
Bullhorn says it has isolated the issue and removed the immediate threat, BleepingComputer reported. A forensic investigation has "not yet determined whether customer data was exfiltrated," the company said in an FAQ. It promised to notify affected people directly if a breach is confirmed.
The company says it serves more than 10,000 customers worldwide, BleepingComputer reported. Its platform handles tasks such as candidate tracking, onboarding and payroll.
BleepingComputer and Cyber Daily gave different pictures of the recovery. Cyber Daily reported that Bullhorn said its Australian, European and U.S. systems were back online by about 5 p.m. on Oct. 19. BleepingComputer reported that most services were still under maintenance or running slowly, with no timeline for full restoration.
Users who do not sign in through a single sign-on system must reset their passwords, and API passwords must be changed, BleepingComputer reported. The company also warned of scams. "Threat actors may pose as Bullhorn personnel via email, text, or phone calls, using the incident as a pretext to request credentials or sensitive information," Bullhorn said, Cyber Daily reported.
Some customers were frustrated. "Our Bullhorn system was offline all weekend and didn't come back on until 9 AM this morning," one wrote, according to Cyber Daily.
What we know: Bullhorn shut its platform after a cyberattack and is restoring service.
What we don't: Whether customer data was stolen and who was behind the attack.
Where outlets agree BleepingComputer and Cyber Daily both report that Bullhorn disabled access to its platform to contain a cyberattack and is working with CrowdStrike.
Where they differ The cited reports agree on the key facts so far.