Bullhorn is the latest tech giant finding itself on the wrong end of a cyberattack, forcing the recruitment software provider to shut down its platform while it investigates.

The US-based company, which serves more than 10,000 customers worldwide, says its systems are now back online in the UK, US, and Australia. Unfortunately for customers hoping to get back to work, online doesn't necessarily mean working.

In its latest status update, published on Tuesday, Bullhorn confirmed that some users were still struggling with single sign-on (SSO), password resets, and customizations, while several products continued to report degraded performance.

Things started going sideways on Friday, October 16, when Bullhorn flagged problems getting job postings onto Indeed. By the following morning, the platform was suffering a full-blown outage, and Bullhorn confirmed later that day that it was dealing with something rather more serious than a technical hiccup.

"We have detected a cyber incident on the Bullhorn Platform. We have temporarily disabled access to our systems in order to contain the activity while we investigate further," the company said, noting that it had roped in cybersecurity specialists from CrowdStrike to help investigate the attack and restore its services.

For recruitment agencies using Bullhorn, the outage meant losing access to candidate records, job applications, placements and, in some cases, the systems used to get people paid.

Services began returning on Monday, but recovery has been anything but seamless. As of Tuesday morning, Bullhorn's status page still listed degraded performance across several products, including its automation tools, Talent Platform, Onboarding365 and Time & Expense.

While Bullhorn is making progress getting customers back into their accounts, it has yet to answer arguably the bigger question: whether the attackers stole anything. In its customer FAQ, it said a forensic investigation is ongoing, and has not yet determined whether attackers exfiltrated customer data.

Bullhorn says it will contact affected customers if the investigation finds their information was compromised, and it also warned people to watch out for opportunistic crooks looking to exploit the chaos.

"Threat actors may pose as Bullhorn personnel via email, text, or phone calls, using the incident as a pretext to request credentials or sensitive information," it warned on Tuesday, stressing that its employees would never ask customers to disclose passwords, multi-factor authentication codes, or verification tokens.

The company has also required password resets for users who don’t log in through SSO, while customers using API integrations have been instructed to rotate their credentials.

The cause of the intrusion remains unknown, and Bullhorn has not publicly identified the attackers or confirmed whether ransomware was involved. The company didn’t respond to The Register’s questions at publication time. 

The outage may be coming to an end, but Bullhorn's investigation into what the attackers actually did is far from over. ®