Two-factor sign-in is now required for every account

From 20 October 2026, every Recruitly account signs in with two steps: your usual sign-in, then a 6-digit code from an authenticator app on your phone. It applies to every user in every agency, and it can't be switched off.

Why now

Last week Bullhorn, one of the largest CRM in the industry, confirmed a cyber incident on its platform. Bullhorn switched off access for its customers to contain it, and recruitment businesses across the US, UK, Europe and APAC lost their CRM, job posting and integrations for several days. Bullhorn has not said how the attackers got in. Recruitly runs on its own, separate systems and was not affected.

Here is what Bullhorn has said so far:

• 17 Oct: it detected a cyber incident and disabled access to the platform while it investigated, with help from CrowdStrike.
• Password resets: every user who does not sign in through single sign-on had to reset their password, and every password used to connect other software to Bullhorn was changed.
• Customer data: a forensic investigation is under way. Bullhorn has not yet determined whether customer data was taken, and says it will contact anyone affected.
• 20 Oct: access was still coming back region by region, with job publishing, reporting and some integrations still limited.
• Impersonation warning: Bullhorn warned that criminals may pose as its staff to ask for passwords or verification codes.

Your CRM holds your candidates' CVs, your clients' contacts and your whole business. A password alone is no longer enough to protect that. Stolen and reused passwords are the most common way into business software, and a second step blocks the large majority of those attacks: Microsoft reports that it stops over 99.9% of account compromise attacks→. So we have made it the rule for everyone, today, rather than after something happens.

What changes for you

• First sign-in after today: you'll be asked to set up two-factor sign-in. Scan the QR code with an authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, Authy or similar), type in the 6-digit code, and you're in.
• Save your recovery codes: you'll get 10 one-time recovery codes. Keep them somewhere safe, like your password manager. If you lose your phone, a recovery code gets you in.
• Every sign-in after that: open your authenticator app and type in the current code. It takes a few seconds.
• Already use two-factor sign-in? Nothing changes, apart from one short notice. If you have no recovery codes left, we'll give you a new set when you sign in.
• Want a fresh set of recovery codes? In Recruitly 2.0, go to My Profile → Security to see how many you have left and create a new set.

We will never ask for your code

Nobody from Recruitly will ever ask for your password, your 6-digit code or your recovery codes, by email, phone, text or chat. If someone does, it isn't us. Don't share it, and tell us at support.

Read more about the Bullhorn incident

• Bullhorn status page→
• BleepingComputer: Bullhorn takes staffing platform offline to contain cyberattack→
• Dysruption Hub: Bullhorn cyber incident leaves recruitment tools impaired→
• Recruitment SAK: what recruitment businesses need to know→

Questions, or locked out without your phone or recovery codes? Ask your account admin or contact our support team.