Bullhorn是最新一家遭受网络攻击的科技巨头，这家招聘软件提供商被迫关闭其平台以进行调查。这家总部位于美国的公司在全球服务超过1万名客户，称其系统目前已在英国、美国和澳大利亚恢复上线。但对于希望重新开始工作的客户来说，上线并不一定意味着正常运行。在周二发布的最新状态更新中，Bullhorn确认，部分用户仍在为单点登录（SSO）、密码重置和自定义设置等问题苦恼，而多款产品仍报告性能下降。
Bullhorn is the latest tech giant finding itself on the wrong end of a cyberattack, forcing the recruitment software provider to shut down its platform while it investigates. The US-based company, which serves more than 10,000 customers worldwide, says its systems are now back online in the UK, US, and Australia. Unfortunately for customers hoping to get back to work, online doesn't necessarily mean working. In its latest status update, published on Tuesday, Bullhorn confirmed that some users were still struggling with single sign-on (SSO), password resets, and customizations, while several products continued to report degraded performance.
问题始于10月16日周五，当时Bullhorn发现将招聘信息发布到Indeed时出现故障。到次日上午，平台已出现全面宕机，Bullhorn当天晚些时候确认，其面临的远比技术故障严重得多。“我们在Bullhorn平台上检测到一起网络事件。我们暂时禁用了对系统的访问，以便在进一步调查期间遏制该活动，”该公司表示，并指出已聘请网络安全专家CrowdStrike协助调查攻击并恢复服务。
Things started going sideways on Friday, October 16, when Bullhorn flagged problems getting job postings onto Indeed. By the following morning, the platform was suffering a full-blown outage, and Bullhorn confirmed later that day that it was dealing with something rather more serious than a technical hiccup. "We have detected a cyber incident on the Bullhorn Platform.
对于使用Bullhorn的招聘机构来说，宕机意味着无法访问候选人记录、工作申请、安置记录，在某些情况下，还无法访问用于支付人员工资的系统。服务于周一开始恢复，但恢复过程远非顺利。截至周二上午，Bullhorn的状态页面仍显示多款产品性能下降，包括其自动化工具、Talent Platform、Onboarding365以及Time & Expense。
We have temporarily disabled access to our systems in order to contain the activity while we investigate further," the company said, noting that it had roped in cybersecurity specialists from CrowdStrike to help investigate the attack and restore its services. For recruitment agencies using Bullhorn, the outage meant losing access to candidate records, job applications, placements and, in some cases, the systems used to get people paid. Services began returning on Monday, but recovery has been anything but seamless.
虽然Bullhorn正在努力让客户重新登录账户，但它尚未回答一个或许更大的问题：攻击者是否窃取了任何数据。
As of Tuesday morning, Bullhorn's status page still listed degraded performance across several products, including its automation tools, Talent Platform, Onboarding365 and Time & Expense.
在其客户常见问题解答中，Bullhorn 表示，取证调查正在进行中，尚未确定攻击者是否窃取了客户数据。Bullhorn 称，如果调查发现客户信息遭到泄露，将联系受影响的客户，同时也警告人们提防趁火打劫、试图利用混乱局面的骗子。“威胁行为者可能通过电子邮件、短信或电话冒充 Bullhorn 人员，以该事件为借口索要凭证或敏感信息，”该公司周二警告称，并强调其员工绝不会要求客户透露密码、多因素认证代码或验证令牌。
While Bullhorn is making progress getting customers back into their accounts, it has yet to answer arguably the bigger question: whether the attackers stole anything. In its customer FAQ, it said a forensic investigation is ongoing, and has not yet determined whether attackers exfiltrated customer data. Bullhorn says it will contact affected customers if the investigation finds their information was compromised, and it also warned people to watch out for opportunistic crooks looking to exploit the chaos.
该公司还要求未通过单点登录（SSO）的用户重置密码，同时指示使用 API 集成的客户轮换其凭证。入侵原因仍不清楚，Bullhorn 尚未公开确认攻击者身份，也未证实是否涉及勒索软件。截至发稿时，该公司未回应《The Register》的提问。虽然中断可能即将结束，但 Bullhorn 对攻击者实际所为的调查远未结束。®
"Threat actors may pose as Bullhorn personnel via email, text, or phone calls, using the incident as a pretext to request credentials or sensitive information," it warned on Tuesday, stressing that its employees would never ask customers to disclose passwords, multi-factor authentication codes, or verification tokens. The company has also required password resets for users who don’t through SSO, while customers using API integrations have been instructed to rotate their credentials. The cause of the intrusion remains unknown, and Bullhorn has not publicly identified the attackers or confirmed whether ransomware was involved. The company didn’t respond to The’s questions at publication time. The outage may be coming to an end, but Bullhorn's investigation into what the attackers actually did is far from over. ®