decrypted · 20 october 2026 · ransomware and cybercrime · supply chain · uk policy and law

Bullhorn goes dark: what a supplier shutdown teaches recruiters

Bullhorn, the recruitment software used by staffing firms worldwide, spent the weekend switched off by its own hand. On 17 October the company said it had detected a cyber incident, disabled access to contain it and brought in CrowdStrike. By the evening of 19 October its applicant tracking and CRM service (customer relationship management, the recruiter's database) was back online in every region. What nobody has said is whether any candidate data was taken.

What the timeline shows

Bullhorn's status page records login errors early on 17 October, a system-wide outage that morning and the cyber incident disclosure that afternoon. Late that night it also disabled its Talent Platform as a precaution. The company says its forensic investigation is under way and it has not determined whether customer data was exfiltrated. No attacker, method or ransomware involvement has been named publicly. Some Bullhorn-owned customisations were still being restored in every region.

Customers without SSO, single sign-on, must reset passwords, and API connections, the way one program talks to another, need new passwords too.

Why a shutdown hurts so much

Picture a shop whose till, stockroom and customer ledger all sit in one rented unit. The landlord finds a break-in and bolts the door. However well you run the shop, you are closed until the landlord says otherwise.

That is software as a service. Job adverts, candidate applications, timesheets and job board feeds all route through one supplier. The first symptom customers reported was job posting failing. Quiet failures like that, a sync that stops or an application that never arrives, are what a defender actually sees.

The phishing that follows

Bullhorn warned that attackers may pose as its staff by email, text or phone to ask for credentials. It says it will never ask for a password or MFA code, the second check on top of a password. A forced mass reset is exactly when a fake reset link works best. Type the address yourself and never follow a link in a message.

The Secure by Design lesson

For the supplier, the question is blast radius. Switching everything off is a responsible way to contain an intruder, but it shows one problem could reach every customer. Designs that isolate tenants and regions let you shut a door, not the building. Ask suppliers how that isolation works before the next incident, not during it.

For UK agencies, preparation is cheap:

Know what personal data you hold there. As data controller, you stay answerable to the ICO, the UK's data regulator, even when the breach is at your supplier.
Test an export. Bullhorn says customers can request one through support, a poor moment to learn you never have.
Write a fallback for taking applications while the system is dark.
List every integration holding a credential, so rotation takes an hour, not a week.

That costs little now and a great deal on a Monday with no database.

Also this week

OpenCode keys exposed. OpenCode, an open-source AI coding agent, told 1.4% of its hosted Console users that API keys they had stored for outside AI providers may have been exposed, with the earliest possible exposure on 17 October. The company calls it a large-scale distillation attack, meaning mass querying of models to copy their behaviour, though some observers say it is a plain breach and the link is unproven. Anthropic and Google blocked keys they believed exposed, OpenAI helped restore access and refund credits, and users reported unauthorised charges from hundreds of dollars to over $1,000. OpenCode says its open-source app and command line tool were unaffected, and has not said how attackers got in. Its team also said its own AI analysis tools stopped helping once the malicious code tripped their safety filters, until it gained access to a model built for vetted defensive work. The design lesson is old: a stored key is someone else's credit card, so use narrow, spend-capped keys and revoke them directly with each provider.

WhatsApp loses a round against NSO. A US judge denied WhatsApp's bid to hold the spyware maker NSO Group in contempt of a 2025 injunction, which came with a $4.4 million fine. The Record reports the judge found the evidence short of the "clear and convincing" standard: WhatsApp relied on one engineer's declaration identifying 23 new accounts, and chose not to detail how it spotted them, arguing that disclosure would help spyware firms. MLex, dated 16 October, also reports the denial. For UK organisations the point is practical. Platform lawsuits abroad protect users only if courts can enforce them, and enforcement needs evidence that defenders may be reluctant to publish. Do not treat litigation as your control for high-risk staff.

Sources

Want help working out what your suppliers could switch off on you? get in touch.