After the Bullhorn Cyberattack, Candidates Can't Tell You From a Scammer

Bullhorn took its platform offline on October 17, 2026, and five days later it still could not say whether customer data had left the building. If your candidates' phone numbers, CVs and placement notes lived in that system, you can't afford to wait for the forensic report to decide what to tell them. If anyone is holding that data, they already know your candidates' names, your name, and the roles you were discussing.

What Bullhorn has confirmed, and what it hasn't

Bullhorn has confirmed a cyber incident, a platform shutdown and an ongoing investigation. It has not confirmed whether data was stolen, how attackers got in, or who they are.

The timeline, from Bullhorn's own statements:

• Oct 17, 3:28pm ET: Bullhorn posted that it had "detected a cyber incident on the Bullhorn Platform" and had "temporarily disabled access to our systems in order to contain the activity."
• Investigators: CISO Owen Meehan told Staffing Industry Analysts the company is "working with leading cybersecurity specialists from CrowdStrike and Kroll."
• Oct 22: Bullhorn Back Office was still offline, and customers were told to "plan for BBO to remain unavailable through the end of this week."
• Data status: the customer FAQ says Bullhorn has "not yet determined whether customer data was exfiltrated," meaning copied out of the system.

Some reports date the outage to Oct 16, 19 or 20. Bullhorn's own status post says Oct 17, so that's the date I'm using. No attacker has been named and ransomware has not been confirmed, so nobody should guess at either.

Why this is a candidate trust problem, not an IT chore

The data at risk is the raw material for a recruiter impersonation scam. Staffing records hold names, contact details, résumés, placement and pay records, and client contacts. That's enough for a scammer to write a message that sounds exactly like you.

Bullhorn's warning is about its own staff: "Threat actors may pose as Bullhorn personnel via email, text, or phone calls, using the incident as a pretext to request credentials or sensitive information." The law firm Emery Reddy takes it one step further: "Similar messages could also claim to come from a staffing agency or recruiter."

That second sentence is the one that matters for you. Your IT team is busy resetting passwords. Nobody is protecting the candidate who gets a text tomorrow quoting the exact role, rate and hiring manager you discussed last Tuesday.

Disclosure timing works against candidates

The official notification chain is slow by design, and that slowness doesn't stop anyone:

1. Bullhorn finishes forensics with CrowdStrike and Kroll.
2. Bullhorn contacts customers, but only if data turns out to be affected.
3. Each staffing firm then works out its own obligation to notify candidates.
4. Candidates finally hear something.

Anyone holding the data skips all four steps.

$501M

The FTC's quarterly numbers show what this costs per person: $150.4M in losses from 25,002 reports in Q4 2025, with a median loss of $2,000 per victim. Separately, the FTC says people lost nearly $1B to business impersonators in 2025. A staffing agency is a business, and your name is the one being borrowed.

Your candidates can't tell whether they were exposed

Candidates have almost no way of knowing whether their agency used Bullhorn, so they don't know whether to be on guard. You're the only person who can tell them.

Here's what Refolk's index of professional profiles shows:

These counts show how rarely recruiters list their ATS. They are not Bullhorn's market share. Bullhorn runs operations for more than 10,000 staffing and recruiting firms, which means far more recruiters use it than mention it. The UK sample is tiny (7, six of them titled "Recruitment Consultant"), so treat it as a hint, not a finding.

0.5%

Recruiters list the skills that win them clients and candidates, not the back-office tools that hold their records. So a candidate who hears "Bullhorn cyberattack" on the news can't look you up and work out whether it affects them. In a sample of 25 profiles from Refolk's index, US recruiters listing Bullhorn work at firms including Manpower, Adecco, AMS and AdventHealth. That shows those people list the skill. It doesn't confirm what those companies run or whether they were affected, and your candidates can't confirm it by guessing either.

The password-reset week is the scammer's script

The week after a platform incident is when impersonation works best, because everyone expects messages about system changes. Thousands of firms are resetting credentials and repairing integrations at once, which one analysis says "hands criminals a ready-made script."

The candidate version of that script is easy to predict. Expect messages like:

• "We're migrating systems after a security incident. Please re-confirm your bank details for payroll."
• "Your placement file was corrupted. Send a photo of your ID so we can restore it."
• "Your onboarding moved to a new portal. Log in with this link."
• "The client wants a quick chat on WhatsApp before Friday."

Each one sounds plausible this month in a way it wouldn't in a normal week. A contractor mid-placement has every reason to believe their agency's payroll system is broken, because it might be.

Send this message before the forensic report

Message your active candidates now, through a channel they already trust, with a note that tells them what you'll never ask for. You don't need to know whether data was stolen to send it. You only need to make the real version of you easy to tell apart from a fake.

Who gets it first:

1. Contractors currently on placement (their pay and ID details are the most valuable).
2. Candidates in late-stage processes with offers pending.
3. Everyone else you've spoken to recently.

If your active pipeline only lives in Bullhorn and it's still unavailable, don't wait for it to come back before you send. Rebuild the list from memory, your inbox and your calendar. Refolk can help with the gaps: describe the person ("the backend contractor I placed at a fintech client in August") and get their profile back so you can reach them on a channel they recognize.

The script

Subject: A security note from [Your Name] at [Agency]

Hi [First name],

You may have seen that Bullhorn, a recruiting software platform used across the staffing industry, had a cyber incident on October 17. [Agency] uses Bullhorn. Bullhorn says it has not yet determined whether any data was taken. I'll tell you directly if I learn your information was affected.

In the meantime, scammers sometimes pose as recruiters after incidents like this. Here is what I will never do:

• Ask you to pay a fee for any job or placement.
• Ask for bank details or ID photos before you have a signed offer.
• Move this conversation to Telegram or WhatsApp.
• Send you a login link to a "new portal" by text.

If anyone contacts you claiming to be me or [Agency], call [Agency]'s main line at [number listed on agency website] and ask for me by name. Don't use a number or link from the message itself.

Thanks, and sorry for the noise. [Your Name]

Send it from the email address or LinkedIn account you've always used with that candidate. A message from a new channel saying "trust this channel" defeats its own purpose.

Turn scam signals into your public rules

The best defense is to say in public that you'll never do the things scammers do, so any message that does them is obviously fake. LinkedIn's own data gives you the two signals to build around.

• Scammers are five times more likely than genuine contacts to come from outside your network. So stay in-network: contact existing candidates from the account they already know.
• Scammers are twice as likely to ask to move the conversation off-platform. So never move off-platform, and say so in writing.

If you've told every candidate you'll never ask for bank details before an offer, the scammer who asks has outed himself.

Put these rules where a candidate checking you out will find them:

• Your LinkedIn About section: one line listing what you'll never ask for.
• Your email signature: "I will never request fees, bank details before an offer, or a move to messaging apps."
• Your agency's careers page: a short "How to verify a recruiter from [Agency]" section with the switchboard number.
• Offer letters: a reminder of where real payroll and onboarding requests come from.

Check whether a fake version of you already exists

A cloned profile copies a real recruiter's name, photo and agency to message that recruiter's candidates. Look for duplicate LinkedIn profiles of your team, "recruiters" claiming your firm that nobody in the office recognizes, and lookalike email domains. Checking every recruiter by hand across LinkedIn and the open web is slow, which is the gap Refolk fills: you describe the profiles you're looking for in plain English and get a ranked list back, so an impostor next to your real team stands out.

Report any clone to LinkedIn and to the FTC, and keep a screenshot. The FTC's Impersonation Rule has been in effect since April 1, 2024.

How to verify a recruiter: what to tell candidates

To verify a recruiter, a candidate should confirm the channel, not just the profile. That means calling the agency's main number from its official website and asking for the recruiter by name. A verification badge alone doesn't prove the message came from the real person.

What the LinkedIn badge proves, and what it doesn't

Since September 2025, LinkedIn has required workplace verification from anyone who adds or changes a recruiter title. Oscar Rodriguez, LinkedIn's VP of Trust, said the goal is to "help job-seekers identify legitimate recruiters and avoid scams." It helps, but it has limits:

• It confirms where someone works. It says nothing about what they intend.
• It doesn't cover the channel. A text or a WhatsApp message carries no badge at all.
• Recruiters who held the title before the change weren't required to verify right away, so a missing badge is a reason to look closer, not proof of fraud.

Stolen pipeline data makes the gap worse. A scammer can quote a real role, a real rate and a real hiring manager through a cloned profile or by text, where no badge can be checked.

A five-step check candidates can actually use

1. Find the agency's official website yourself. Search for it. Don't click the link in the message.
2. Call the main number listed there and ask for the recruiter by name.
3. Compare the sender (email domain, phone number, profile URL) with what the agency confirms.
4. Refuse any off-platform move or upfront request for fees, bank details or ID before a signed offer.
5. Report anything suspicious to the agency, to LinkedIn if a profile is involved, and to the FTC.

Send this list along with your script, or link to it from your careers page.

FAQ

Was candidate data stolen in the Bullhorn cyberattack?

Nobody knows yet. Bullhorn's customer FAQ says its forensic investigation, with CrowdStrike and Kroll, is ongoing and it has "not yet determined whether customer data was exfiltrated." No entry point or threat actor has been identified, and no group has claimed the attack.

Should I tell candidates before Bullhorn confirms anything?

Yes. Your message doesn't need to claim their data was taken. It only needs to explain what happened, say what you'll never ask for, and tell them how to verify you. Bullhorn will notify customers only if data turns out to be affected, and anyone holding stolen data won't wait for that.

Does a missing LinkedIn verification badge mean a recruiter is fake?

No. LinkedIn has required workplace verification for new or changed recruiter titles since September 2025, but recruiters who already held the title weren't required to verify right away. A missing badge is a reason to check through the agency's switchboard. It isn't proof of fraud.