Bullhorn Recovery: Beware of Fake Support Requests

Bullhorn, whose software supports staffing and recruitment businesses, confirmed a cyber incident on 17 October and said it had temporarily disabled system access to contain the activity. Its ATS/CRM incident update dated 20 October now says all regions are online and monitoring continues.

That update is narrower than an all-clear for the entire platform. Bullhorn says its own customizations are still being brought online, notes that some password resets may loop, and asks customers with continuing single-sign-on problems to try again after fixes and contact support if the issue persists. Check the official status page for the latest position rather than relying on an earlier outage headline.

Bullhorn's latest warning is about potential social engineering: someone may pose as company personnel by email, text or phone and use the incident as a reason to request credentials or sensitive information. The warning does not establish that every customer has been targeted or that a particular message is malicious.

A genuine disruption makes a fake repair request more plausible. Recruiters may be waiting to regain access, while candidates may be expecting onboarding messages. Neither urgency nor knowledge of the outage proves that a caller or link belongs to Bullhorn or your recruitment agency.

BleepingComputer reported on 19 October that Bullhorn had not yet determined whether customer data had been exfiltrated. Treat that as the reported position at that time, not proof that data was stolen or proof that no breach occurred. The recovery update cited here does not settle that question.

Open your usual bookmarked login or reach support through a route you already know. Do not follow an unsolicited reset link simply because it mentions the incident. Bullhorn explicitly says it will not ask you to share your password, MFA codes or verification tokens through email, phone, text or another channel.

If you work for a staffing business, follow your administrator's recovery instructions. BleepingComputer's 19 October report described password resets for non-SSO users and API-password rotation for integrations; those are administrator tasks to confirm against Bullhorn's current official guidance, not a reason to send credentials to someone offering help.

If you are a candidate or temporary worker and receive an unexpected request to resubmit identity documents, change payment details or use a new onboarding link, contact your agency using an established number or existing conversation. This is a precaution, not a claim that candidate identity or payroll data has been confirmed stolen.

If you have already shared a password or security code with a suspected impersonator, notify your agency or IT team promptly through a trusted channel. Change the affected password through the genuine service and ask the administrator to review active sessions and account activity; changing a password alone may not end every session.

A VPN protects traffic between your device and the VPN service, reducing what a local network operator can observe. It cannot restore Bullhorn's systems, determine whether the provider lost data, or prove that a person claiming to be support is genuine.

An encrypted connection can still carry a password to a fraudulent website. For this incident, independent identity checks, careful credential handling and the provider's current recovery instructions matter more than changing VPN servers or buying another security subscription.