Bullhorn is the latest tech giant finding itself on the wrong end of a cyberattack, forcing the recruitment software provider to shut down its platform while it investigates. The US-based company, which serves more than 10,000 customers worldwide, says its systems are now back online in the UK, US, and Australia. Unfortunately for customers hoping to get back to work, online doesn't necessarily mean working. In its latest status update, published on Tuesday, Bullhorn confirmed that some users were still struggling with single sign-on (SSO), password resets, and customizations, while several products continued to report degraded performance. Things started going sideways on Friday, October 16, when Bullhorn flagged problems getting job postings onto Indeed. By the following morning, the platform was suffering a full-blown outage, and Bullhorn confirmed later that day that it was dealing with something rather more serious than a technical hiccup. "We have detected a cyber incident on the Bullhorn Platform. We have temporarily disabled access to our systems in order to contain the activity while we investigate further," the company said, noting that it had roped in cybersecurity specialists from CrowdStrike to help investigate the attack and restore its services. For recruitment agencies using Bullhorn, the outage meant losing access to candidate records, job applications, placements and, in some cases, the systems used to get people paid. Services began returning on Monday, but recovery has been anything but seamless. As of Tuesday morning, Bullhorn's status page still listed degraded performance across several products, including its automation tools, Talent Platform, Onboarding365 and Time & Expense. While Bullhorn is making progress getting customers back into their accounts, it has yet to answer arguably the bigger question: whether the attackers stole anything. In its customer FAQ, it said a forensic investigation is ongoing, and has not yet determined whether attackers exfiltrated customer data. Bullhorn says it will contact affected customers if the investigation finds their information was compromised, and it also warned people to watch out for opportunistic crooks looking to exploit the chaos. "Threat actors may pose as Bullhorn personnel via email, text, or phone calls, using the incident as a pretext to request credentials or sensitive information," it warned on Tuesday, stressing that its employees would never ask customers to disclose passwords, multi-factor authentication codes, or verification tokens. The company has also required password resets for users who don’t log in through SSO, while customers using API integrations have been instructed to rotate their credentials. The cause of the intrusion remains unknown, and Bullhorn has not publicly identified the attackers or confirmed whether ransomware was involved. The company didn’t respond to The Register’s questions at publication time. The outage may be coming to an end, but Bullhorn's investigation into what the attackers actually did is far from over. ®

The UK public sector has reached a cyber resilience inflection point. A new Prime Minister has taken office, and significant machinery-of-government changes have already been announced, including the scrapping of DSIT, the department that had become the center of government digital, technology and cyber policy. Its responsibilities are now being redistributed across other parts of Whitehall, creating a new policy and delivery landscape for public sector leaders to navigate. For years, cyber security was treated as a specialist operational discipline that was essential but largely delegated to technical teams. That model is no longer sustainable. Pressure is now coming from three directions at once, as policy raises expectations for boards and senior leaders, organizational reform reshapes how services, systems and suppliers connect, and technology change, from cloud and hybrid work to AI, expands both opportunity and exposure. Together, these forces mean cyber resilience can no longer sit below board level. Public services, from healthcare and benefits to transport, education, local government and emergency response, are now so digitally dependent that a cyber incident is not simply an IT outage. It is a risk to public trust, public safety and the continuity of government itself. Recent history shows what this means in practice. The 2024 ransomware attack on Synnovis, a pathology services provider to parts of the NHS, significantly reduced the capacity to process blood, urine and specimen tests, caused disruption across south-east London and contributed to delays affecting more than 11,000 outpatient and elective procedure appointments. Incidents like this turn abstract cyber risk into real-world service disruption, making resilience a boardroom issue rather than a back-office concern. Cyber resilience is no longer a technical aspiration, but a leadership obligation shaped by policy, organizational and technology change. Policy change has made cyber resilience a leadership obligation The direction from government and the National Cyber Security Centre is clear. The Cyber Resilience Pledge asks organizations to make cyber security a board-level responsibility, register for NCSC Early Warning and take a risk-based approach to Cyber Essentials across their supply chains. The NCSC’s Cyber Governance Code of Practice reinforces the point that cyber risk must be governed like any other material organizational risk. The Cyber Security and Resilience Bill will further expand expectations across essential and digital services, strengthening incident reporting and bringing more critical suppliers into scope. This matters because the scale and impact of cyber threats facing the UK are increasing sharply. The NCSC handled 204 nationally significant cyber incidents in the year to September 2025, up from 89 the previous year. That means the UK is now experiencing an average of four nationally significant cyber attacks every week. Policy has therefore changed the boardroom question. Leaders should no longer ask only whether an organization has invested in security tools. They need to ask whether they can prove resilience, evidence accountability and continue delivering critical services when systems are under pressure, suppliers are compromised, data access is disrupted or attackers are already inside the network. Organisational change is creating hidden cyber risk The second force is organizational change. Local Government Reorganisation is redrawing structures and responsibilities across England. Rail renationalization and other shifts in public ownership are changing who owns, manages and secures critical data and systems. Departmental priorities and delivery models are also evolving under a new Prime Minister, with DSIT being dismantled and functions including digital transformation, public sector AI adoption, information resilience and online harms moving into different departments and central government structures. Every one of these transitions creates potential gaps. Systems need to be integrated. Identity and access privileges need to be reassessed. Data needs to move between teams, agencies and suppliers. Contracts and responsibilities need to be redefined. During periods of change, the attack surface expands, and accountability can become blurred. This is why cyber resilience must be built into public sector reform from the outset. The question is not simply how to restructure services efficiently. It is how to ensure citizens can continue to access those services securely throughout the transition. Reorganization without resilience is a risk to the public. Technology change demands continuous assurance The third force is technology change. Public sector work now happens across hybrid environments, shared services, cloud platforms, partner ecosystems and complex supply chains. Traditional security models were built for a more stable world of fixed offices, predictable networks, known users and clearly defined organizational boundaries. That world no longer exists. AI makes this problem more urgent. AI is already being used across the public sector to improve productivity, analyze information and support better service delivery. But without governance, organizations can quickly lose track of which tools are being used, what data they can access and whether sensitive information is being exposed. Shadow AI is not a future risk. It is a present governance challenge. Resilience in this environment requires continuous assurance. Access should not be granted simply because a user is on a trusted network. Every request should be verified based on identity, context, device posture and risk. Users should only receive the access they need, when they need it. Applications should be protected from unnecessary exposure. Data should be segmented so that compromise in one area does not automatically spread across the organization. What public sector boards should do now Making cyber resilience a board-level priority does not mean every director needs to become a technical expert. It means senior leaders need the right governance, evidence and accountability to respond to the three forces reshaping risk across the public sector. That starts with treating cyber resilience as a standing board agenda item, linked directly to service continuity, citizen trust, regulatory exposure and reform delivery. It also requires boards to understand which critical services depend on which systems, suppliers and datasets, where single points of failure exist, and how disruption in one part of the ecosystem could affect citizens’ ability to access essential services. Supply chain assurance must be part of that same conversation. Public services are delivered through ecosystems, so resilience cannot stop at the boundary of a single department, council, agency or trust. Cyber Essentials, supplier checks, contractual obligations and clear incident reporting expectations should be embedded into procurement and contract management. At the same time, public bodies need to move away from implicit trust based on networks or locations and towards continuous verification based on identity, context, device posture and risk. Users should have only the access they need, when they need it, and AI adoption should be governed before it scales so innovation does not create unmanaged routes to sensitive information. Resilience is now a test of public sector leadership The UK’s policy environment has changed. Public sector organizations are changing. Technology is changing even faster. The only way to manage that complexity is to build cyber resilience into the way public services are governed, transformed and delivered. The public sector cannot afford to treat resilience as something to retrofit after legislation tightens, reform programs are complete or AI adoption has already accelerated. It must be designed in from the outset, measured at leadership level and tested continuously. Cyber resilience is not just about protecting systems. It is about protecting the public’s ability to rely on government when policy, organizations and technology are all changing at once. That makes it a board-level priority by definition. More Information on how Zscaler supports public organizations can be found here. Contributed by Zscaler

The US Department of Homeland Security on Monday issued an order directing federal civilian agencies not to use technology products from Chinese AI lab DeepSeek, and to remove any existing implementations. The order [PDF] is broad, as it requires agencies to ditch "all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations." Complying will be tricky as it is not clear which third-party products and services have been developed using DeepSeek's wares. Nor is it clear whether "developed using" means providing ongoing access to DeepSeek models via API or simply refers to any app vibe-coded with the help of DeepSeek. It also leaves open the question of AI gateways. Services such as OpenRouter and Vercel AI Gateway make DeepSeek's models available through APIs. And those using gateway services may find themselves using DeepSeek models without meaning to do so. OpenRouter, for example, "routes requests to the best available providers for your model." It selects what the service deems to be the best fit provider of AI services. Vercel AI Gateway does the same by default. So federal civilian agencies could be using DeepSeek models inadvertently, if they haven't taken steps to constrain their AI providers. A DHS spokesperson did not immediately respond to a request for comment. US officials have contemplated a ban on DeepSeek since the China-based AI lab released DeepSeek-R1 in early 2025. On February 6, 2025, US Representative Darin LaHood (R-IL) and US Representative Josh Gottheimer (D-NJ) introduced the No DeepSeek on Government Devices Act. The lawmakers characterised DeepSeek as a national security threat because its AI models purportedly capture data on US citizens and provide it to the Chinese government. The bill never made it out of committee, but various government agencies followed through. The US Defense community and lawmakers have already exiled DeepSeek. The Defense Information Systems Agency (DISA) started blocking DeepSeek on the Pentagon’s IT networks in January 2025. The US Navy, NASA, and the US House of Representatives took similar steps. So did various US states. While the DHS announcement has taken a long time to reach civilian agencies, its timing may be a boon for American AI companies which, like Anthropic, hope to soon go public. That's because open weight models represent competition, and those from China have proven particularly popular both in terms of capabilities and cost. Government agencies that cannot deploy such models (and the taxpayers who fund those agencies) may be stuck paying the prices set by favored US model makers. Concerns about the security and privacy of DeepSeek's iOS mobile app surfaced shortly after DeepSeek-R1 debuted. Several months later, a December 2025 report on the DeekSeek mobile app for Android and iOS cited similar concerns, including plaintext information leaks, links to servers run by Chinese tech firms, and shortcomings like lack of SSL pinning. These issues, however, are mainly mobile security problems that afflict many apps, particularly those that integrate third-party advertising SDKs from companies based outside the US. They don't really address the additional risks posed by the capture of text prompts and responses, or how local secrets and other sensitive information can be ingested by AI agents. Katie Moussouris, founder and CEO of Luta Security, told The Register in an email that while there are legitimate national security reasons to keep DeepSeek's app and servers away from government systems, the way this particular order is written exceeds that requirement in ways that aren't practical. "Banning DeepSeek's own app and API is workable," said Moussouris. "The problem is the ban on 'third-party products and services developed using DeepSeek implementations.' The order doesn't say what 'developed using' means. It could technically cover any model derived from DeepSeek and more importantly, any software whose developers used DeepSeek to write or test code. An AI software bill of materials doesn't record which tools developers used, so it would be no real help. Every vendor would have to attest that nothing it relies on ever touched DeepSeek. There's no practical way to verify that." Moussouris also took issue with the breadth of the order, noting that applying the rules to US-hosted versions of DeepSeek's models goes too far. "The risks the order cites are mostly about data flowing to DeepSeek's servers in China, its data collection, and its app," she said. "US hosting avoids most of those. "For the model itself, the order says only that it may contain malware or vulnerabilities, which is true of all software. NIST found DeepSeek more vulnerable to prompt injection than US models, though every model has that problem. NIST also found it easier to jailbreak, but jailbreak guardrails often get in the way of defenders." ®

Dutch grocery giant Ahold Delhaize, which operates US supermarket chains Food Lion, Giant Food, and Stop & Shop, said it proactively took IT systems offline following a cyberattack, affecting most of its US and European brands. The multinational chain originally disclosed the incident on October 12. “Ahold Delhaize is experiencing a security issue within its network,” it said at the time, adding that security teams, working to mitigate the issues, took “some” IT systems offline. On Monday, the company confirmed that it proactively took certain IT systems, including websites and apps, offline, affecting most of its brands, and said that “malicious actions of others” caused the security issue. “Taking systems offline to help protect them was a precautionary measure that affected most of our brands across Europe and the United States,” Frans Muller, president and CEO of Ahold Delhaize, said in a Monday statement. “The investigation to date confirms this was the right decision.” At this time, all of the physical stores remain open, and the investigation hasn’t uncovered any evidence to suggest the miscreants stole any “sensitive customer, associate, or partner data,” the disclosure said. The company last week notified the Dutch National Cyber Security Centre about the digital intruders, and on Monday filed a report with the Dutch police, according to the statement. Albert Heijn’s website and app are back online, and the company expects home deliveries to resume on Friday. Belgian e-commerce is fully operational, and e-commerce services at Ahold Delhaize’s American brands (Food Lion, Giant Food, Martin’s, Hannaford, and Stop & Shop) are expected to work “in the coming days.” The Etos and Gall & Gall websites are also up and running, along with the “majority of websites and apps” across brands serving central and southeastern Europe. Ahold Delhaize did not immediately respond to The Register’s questions about the cyberattack, including whether it was linked to attacks on refrigeration controllers at hundreds of French supermarkets beginning October 11. The attacks reportedly pushed temperatures as high as 122°F (50°C), spoiling food and causing fires at some locations. This latest cyberattack is Ahold Delhaize’s second in two years. A November 2024 digital break-in disrupted brands across the organization, with some Stop & Shop stores struggling to fill prescriptions, while Food Lion employees reported delayed and missing deliveries. INC Ransom claimed responsibility for the attack at the time and leaked some documents reportedly taken from the retailer's systems. Ahold Delhaize ultimately determined more than 2.2 million people’s data - including personal, financial, and health details - had been compromised. ®

A judge ordered Abdulrahman Alfozan to remain in custody, likening the Saudi government’s offer to secure the former OpenAI engineer’s release to a “blank check.”