Bullhorn Data Breach

Bullhorn, a software company that thousands of staffing and recruiting agencies use to manage job candidates and workers, confirmed a cyber incident on October 17, 2026. It shut down its platform for about two days and says it has not yet determined whether customer data was taken.

Bullhorn, Inc. is based in Boston, Massachusetts. It makes an applicant tracking system, the database where recruiters store records on job candidates, placed workers and the companies they hire for. According to BleepingComputer, Bullhorn has more than 10,000 customers worldwide.

How the Bullhorn Cyber Incident Unfolded

Staffing agencies first noticed trouble around October 16 and 17, when they could not post jobs. Bullhorn initially described the problem as a “system-wide outage,” according to BleepingComputer.

On the afternoon of October 17, Bullhorn posted this statement on its public status page:

“We have detected a cyber incident on the Bullhorn Platform. We have temporarily disabled access to our systems in order to contain the activity while we investigate further. We are working with cybersecurity specialists from Crowdstrike and will resume access when the activity is safely resolved.”

Later that night, Bullhorn also shut off access to its Talent Platform. On October 19, Bullhorn brought its main system back online in the United States, the UK and Europe, and Australia. It required a password reset for every user who does not sign in through a company login system (called single sign-on), and it changed every password used to connect other software to its platform. The Talent Platform came back that evening. As of October 20, Bullhorn’s status page says all regions are back online, and its Time & Expense system is fully restored. Bullhorn still has not said whether any data was taken.

Was Personal Information Taken? Bullhorn Has Not Said Yet

Bullhorn says its investigation is still underway. In a customer FAQ updated October 19, the company wrote:

“Our forensic investigation is ongoing, and we have not yet determined whether customer data was exfiltrated. If we determine that your data was affected, we will contact you as soon as possible.”

“Exfiltrated” means copied or moved out of a computer system without permission. Bullhorn says the incident affected its ATS/CRM product, its core recruiting system. The company says there is “no indication” that its other products were affected, including its Salesforce-based products.

Bullhorn has not said how many people have records in the affected system. It has not said what kinds of information, if any, were involved.

Why Many Workers Have Never Heard of Bullhorn

Most job seekers never deal with Bullhorn directly. They apply through a staffing agency’s website, talk with the agency’s recruiters and get paid on the agency’s payroll. Bullhorn’s software runs behind the scenes, often under the agency’s own brand.

This matters for how people may learn about the incident. Bullhorn says it will notify its customers, the staffing agencies, “according to applicable data privacy laws and its contractual commitments.” As a result, any notice an individual receives may come from a staffing agency they applied through or worked for, not from Bullhorn.

Some workers may recognize the Bullhorn name from timesheets. Bullhorn Time & Expense is a time entry system that some agencies give to their contract and temporary workers.

What Information Do Staffing Agencies Keep in Bullhorn?

Bullhorn has not said what information, if any, was involved in this incident. In general, staffing agencies use Bullhorn’s ATS/CRM to keep records on:

• Job candidates and applicants, including resumes, contact details and work history
• Temporary and contract workers the agency has placed in jobs, including placement records
• Hiring managers and other contacts at the agency’s client companies

Bullhorn’s FAQ also states that data from its Time & Expense, Talent Platform and Onboarding 365 products syncs into ATS/CRM. Those products support timesheets, payroll and onboarding for placed workers. What each agency stores depends on how that agency uses the software.

What Is Bullhorn Offering?

Bullhorn has not announced credit monitoring or any other services for individuals. Its steps so far have focused on its business customers: shutting down access, bringing in CrowdStrike to investigate and forcing password resets. Bullhorn says it will contact customers if it finds that their data was affected.

Scammers May Use the Bullhorn Name

Bullhorn has warned its customers that “threat actors may pose as Bullhorn personnel via email, text, or phone calls, using the incident as a pretext to request credentials or sensitive information.” A threat actor is a hacker or scammer. A pretext is a made-up reason to ask for something. Similar messages could also claim to come from a staffing agency or recruiter.

Anyone who has applied for a job or worked through a staffing agency can take these steps:

• Do not give out passwords or verification codes by phone, text or email.
• Call the staffing agency directly, using a phone number from its official website, to check any message about the incident.
• Watch bank, credit card and payroll accounts for activity you do not recognize.
• Consider a free credit freeze with Equifax, Experian and TransUnion.
• Save any letter or email you receive about the incident.

Do You Have Legal Options?

Companies that store job applicants’ and workers’ personal information have a duty to protect it. If the investigation shows that personal information was taken, the people affected may have legal rights and remedies. Emery | Reddy is investigating the Bullhorn cyber incident on behalf of people who applied for jobs or worked through staffing and recruiting agencies.

Contact Emery | Reddy today for a Free Case Review.

Bullhorn Cyber Incident FAQ

Is the Bullhorn cyber incident a data breach?

Not confirmed. Bullhorn confirmed a cyber incident on October 17, 2026. As of October 19, it says it has not yet determined whether customer data was taken. If Bullhorn finds that data was taken, it says it will notify its customers.

How many people were affected?

Bullhorn has not said. It has not shared how many people have records in the affected system. The figure of more than 10,000 customers reported by BleepingComputer counts businesses, not individual people.

I have never used Bullhorn. Could my information be in its system?

It is possible. If you applied for a job or worked through a staffing or recruiting agency, that agency may use Bullhorn to store your records. Many agencies use Bullhorn behind the scenes under their own name.

Who will tell me if my information was involved?

Bullhorn says it will notify its customers, which are staffing agencies. That means a letter or email may come from an agency you applied through or worked for, not from Bullhorn itself.

What should I do right now?

• Make a list of the staffing or recruiting agencies you have applied through or worked for.
• Watch your bank, credit card and payroll accounts.
• Consider a free credit freeze with the three credit bureaus.
• Keep any notice you receive about the incident.
• Contact Emery | Reddy for a free case review.

How can I protect myself from scams that mention the incident?

Scammers often use news of a cyber incident to make fake messages look real. To protect yourself:

• Never share passwords, verification codes or your Social Security number with someone who contacts you first.
• Do not click links or open attachments in unexpected messages about the incident.
• Contact the company directly using a phone number or website you already trust.
• Report suspicious messages to the company they claim to come from.

Has a lawsuit been filed?

As of October 19, 2026, Emery | Reddy has not found any lawsuit filed against Bullhorn over this incident. The firm is investigating.

Do I have a legal claim?

Companies that collect your personal information have a duty to protect it and to tell you promptly if it is compromised. If your information turns out to be involved in the Bullhorn incident, you may have legal rights. Contact Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.