Bullhorn's Job Publishing Is Still Offline. Fill This Week's Reqs Outbound

Bullhorn's core ATS and CRM started coming back on Oct 19, but job publishing is still offline. That cuts off inbound applications for the agencies that run on Bullhorn. Bullhorn is also warning that attackers may pose as its staff, which gives every candidate a new reason to ignore a recruiter message they weren't expecting. This is how to fill this week's reqs anyway: build shortlists outbound, and write outreach a candidate can check without clicking anything.

What is still broken after the Bullhorn cyberattack?

Bullhorn's Known System Limitations page (last updated Oct 20, 10:40 AM ET) lists job publishing as "Not Available (Offline)," along with several integrations and legacy APIs. Core ATS and CRM records are back. The connections that bring candidates in and push data out are not.

Some aggregator sites put the start of the Bullhorn outage on Oct 19 or Oct 20. Those dates are wrong. The Register and BleepingComputer give the correct timeline:

As of that update, these are still unavailable:

• Job publishing
• Integrations with Analytics, Time & Expense, Onboarding 365, Talent Platform, Automation and BBO
• Legacy SOAP APIs
• Canvas
• Some admin settings, including adding new users

CrowdStrike is leading the forensic work. Bullhorn hasn't said whether data was taken, who the attackers are, or whether this was ransomware. Users who don't sign in through SSO have to reset their passwords, and API credentials have to be rotated. This changes daily, so check status.bullhorn.com and the Known Limitations page before you act on anything here.

Why will job publishing come back last?

Job publishing will come back last because Bullhorn deliberately pulled out what it ran on. Bullhorn says it "removed underlying technology that supported a significant number of features," so publishing has to be rebuilt, not just switched back on.

The incident started when the Indeed feed failed on Oct 16. Core ATS returned within about three days, and that same publishing channel is still offline.

Inbound broke first and will come back last. Plan this week's reqs as if it never returns.

So if your ATS is down and you're wondering what to do, plan for zero inbound this week. Don't hold a req for a posting that might go live "any day now." If publishing comes back early, treat the applications as a bonus on top of a pipeline you already built.

First move: get your live shortlists out of Bullhorn

Ask Bullhorn for a data export now. It will provide exports on request, and having your live pipelines outside the platform protects you from whatever breaks next.

Ask for:

• Open jobs, with intake notes and client requirements
• Recent submittals and where each one stands
• Candidates currently in interview stages
• Client contacts for each open req

Next, find out which of your inbound applications are delayed rather than lost. The vendor behind a Bullhorn WordPress job-board plugin (bullhornplugin.com) says its scripts save applications locally and resubmit them once the API is back. Recruitment SAK has also published guidance for affected agencies. Ask your job-board and plugin vendors directly whether they queue submissions. If they don't, anything submitted during the outage may be gone, and your career page should say that.

Why keyword search undercounts the people you need

Skill tags show what people want to be hired for, not the tools they use every day, so keyword search returns only a small part of the real pool. Bullhorn proves this with its own users. In Refolk's index, only 4,226 people across the US, UK and Australia list Bullhorn as a skill, while Bullhorn has more than 10,000 customer firms.

0.42

Every one of those firms has recruiters working in Bullhorn, and still fewer than one person per two firms bothers to tag it. Nobody gets hired for knowing their ATS, so it never makes it onto a profile. Candidates behave the same way. A backend engineer may list "distributed systems" and "leadership" instead of the language they write daily, because that's the job they want next.

This is the main problem with sourcing candidates without job postings. Without inbound, it's tempting to run Boolean strings against skill fields and call the results your pool. But skill fields are mostly empty. The people you're actually looking for show up as evidence of the work they've done.

How to rebuild a shortlist without inbound

Start by describing the person the req needs, then search the places where that kind of work leaves traces: code, job histories and public output. Matching keywords is the fallback, not the starting point.

1. Rewrite the req as a person, not a list of keywords. "Has shipped payment reconciliation at a Series B fintech" beats "Java, Kafka, fintech."
2. Read GitHub for proof of the work. Look at commits, merged pull requests and the repos people actually maintain, in the stack the client uses. Recent activity counts for more than star counts.
3. Read job histories for patterns, not skill fields. Look at company types, how long people stay, how their titles progress, and moves out of companies that just ran the same playbook your client needs.
4. Search the open web for public output. Conference talks, product launch posts, engineering blogs and papers all name real people doing real work.
5. Match identities across sources. The GitHub handle, the profile and the conference speaker should be one person before they go on your list.
6. Rank against the req and stop. A short, ranked list you can defend to a client is better than a long one you haven't screened.

Steps 2 through 5 are slow by hand, especially when the req was written for an inbound funnel that has stopped working. That's the gap Refolk closes: you describe the person in plain English and get back a ranked shortlist drawn from GitHub, LinkedIn and the open web, with the evidence attached to each name.

Recruiter outreach that candidates won't mistake for phishing

Make every message something the candidate can verify. Reference something specific they've done publicly, send from your firm's own domain, and never include login links, attachments, or requests for an ID number or a fee. Bullhorn's warning is specifically about impersonators asking for passwords and MFA codes, and candidates have heard it.

The phishing problem was there before the breach. The breach just makes it worse. FTC data shows how much this costs:

• Reported losses to job and employment-agency scams rose from $90M in 2020 to $501M in 2024.
• In Q4 2025 alone, the FTC logged 25,002 job-scam reports, $150.4M lost, and a $2,000 median loss.
• In 2025, more than $2.1B in impersonation losses traced back to social platforms, an eightfold rise since 2020.
• Nearly one in three people who lost money were first contacted on social media.

$501M

Social platforms are where impersonators make the most money, so a cold message on one from a recruiter the candidate has never heard of now looks like the scam pattern. Being polite doesn't fix that. Being checkable does.

The checkable-outreach checklist

• Open with something public and specific. Name the repo, the talk or the launch. A scammer working from a scraped list can't do this.
• Send from a domain that matches your firm. Avoid free webmail and lookalike domains.
• No links to log in to, and no attachments. Put the job details in the message itself.
• Never ask for an ID number, bank details or a fee. Say so in the message.
• Give them a way to check you independently. Point to your profile, your firm's careers page, or a phone number listed on your firm's own website.
• Don't mention Bullhorn unless they ask. Bringing up the breach in a cold message is the kind of thing a phisher does.

A first line like "Your talk on idempotent payment retries at a fintech meetup is why I'm writing" does two jobs at once. It shows you looked at their work, and it proves you're a real person who did. If you sourced from evidence in the previous step, you already have that line. With Refolk, the evidence comes back next to each name, so the specific reference is right there when you write.

Your own recruiters are a target list too

The people who list Bullhorn as a skill are exactly who an impersonator wants to reach, and they work in-house as well as at agencies. Clean up your own side before you start a high-volume outbound push.

In Refolk's index, current employers of people who list Bullhorn include TEKsystems, Experis, PMC Medical Staffing and Bullhorn itself. In-house teams show up too. In a UK sample of 25 profiles, Google appeared twice among current employers. That sample is too small to support any claim about share, but it shows Bullhorn credentials sit inside corporate TA teams as well as staffing firms, and those people are just as exposed to social engineering.

Before your team sends a single outbound message this week:

• Confirm every non-SSO user has reset their password.
• Rotate the API credentials behind every integration you own, including the ones that are still offline.
• Tell recruiters that any request for a password or MFA code is hostile, no matter whose name is on it.
• Agree on one internal channel for Bullhorn updates, so nobody acts on an email that only looks official.

Score the inbound backlog when it lands

When publishing returns, queued applications may arrive all at once, and the outbound shortlist you build this week becomes the benchmark you score them against. Agencies without one will have to sort the backlog with nothing to compare it to.

The mechanism is the plugin behavior described earlier. Vendors holding applications locally will resubmit them once the API is back, so days of applications can land in your ATS together. If you already have five strong outbound candidates on a req, screening that batch is simple: does an applicant beat your current fifth-ranked person? If not, they go to a lower tier.

It also changes the conversation with clients. The weekly update becomes "here's the shortlist, and inbound will be scored against it when it's back," rather than "we're waiting on Bullhorn." That's why sourcing during a Bullhorn outage is worth the effort even if publishing comes back sooner than expected.

FAQ

Is Bullhorn job publishing back yet?

As of Bullhorn's Known System Limitations page update on Oct 20 at 10:40 AM ET, job publishing was listed as "Not Available (Offline)," along with several integrations, the legacy SOAP APIs and Canvas. Bullhorn removed the underlying technology on purpose, so publishing is being rebuilt, not restarted. Check status.bullhorn.com and the Known Limitations page for the current state before planning around it.

Was candidate data stolen in the Bullhorn cyberattack?

Bullhorn hasn't said. CrowdStrike is leading the forensic investigation, and Bullhorn hasn't disclosed whether data was taken, who the attackers were, or whether ransomware was involved. Until it does, it's prudent to assume contact details could be exposed. That's one more reason your outreach should be easy for a candidate to verify on their own.

How do recruiters contact candidates without looking like phishing?

Open with a specific reference to something the candidate has done publicly, send from your firm's own domain, and leave out login links, attachments and any request for ID numbers, bank details or fees. Give them a way to check you that doesn't depend on your message, such as your profile or your firm's careers page. The FTC traced more than $2.1B in 2025 impersonation losses to social platforms, so candidates are right to be wary of messages they can't check.

Will applications submitted during the Bullhorn outage be lost?

Not necessarily. Some third-party tools, including a Bullhorn WordPress job-board plugin, save applications locally and resubmit them once the API comes back. Others may not. Ask each of your job-board and plugin vendors whether they queue submissions, and if one doesn't, tell candidates on your career page so they know to apply again.