Cyberattack on Jerome School District in Idaho Forces Monday Class Cancellations
An Idaho school district canceled classes on October 19 after a cyber incident disrupted its network and communications. Authorities are investigating.
Incidents
Bullhorn Restores ATS/CRM Services After Cyberattack, Warns of Fake Support Scams
Bullhorn has restored regional services after a cyber incident and warns of scammers posing as support staff. Its data investigation is ongoing.
On October 19, Bullhorn said its ATS/CRM services had been restored in all regions after a cyber incident. The company also warned that people are posing as its staff to try to get passwords and authentication codes from users.
What’s new
Bullhorn confirmed the incident itself on October 17. Monday’s update said access had been restored in Australia, EMEA/UK and the US, and that some single sign-on (SSO) issues had been fixed.
Having services back online doesn’t mean the work is finished. Bullhorn is investigating with help from CrowdStrike specialists, and some features and integrations are still limited. Staffing and recruitment firms use the platform to manage candidates and clients.
The company has not yet determined whether customer data was stolen. Nothing published so far links the incident to a specific group or identifies it as a ransomware attack.
Beware of fake support
Bullhorn warns that criminals may use the incident as an excuse to contact users by email, text message or phone. An employee trying to get back into a critical system is more likely to accept that kind of message as part of the recovery effort.
The vendor says it never asks for passwords, MFA codes or verification tokens. Share this warning with people outside IT who use the platform, too.
What to do now
- Check Bullhorn’s official updates for current service status and limitations.
- Give recruiters clear instructions on how to verify anyone claiming to be from support.
- Change passwords only on the service’s known website, opened directly rather than through a link.
- Test your integrations and make any credential changes the vendor requires.
- Keep records of process disruptions and of any notices about possible impact on data.
SecurHUB’s take
An incident at a vendor can stop your work and open the door to scams at the same time. Incident response should cover communication with users and a safe restart of the processes that depend on the vendor.
Sources: Bullhorn Status, BleepingComputer, CyberStack
