Gulshan Management Services Discloses Data Breach Affecting 377,000 Individuals

A filing with the Maine Attorney General’s Office, which requires organizations to disclose the number of individuals impacted by cybersecurity incidents, revealed that a company operating gas stations in Texas has suffered a data breach affecting more than 377,000 individuals. The disclosure was made by Gulshan Management Services, Inc., apparently associated with Gulshan Enterprises, which manages roughly 150 Handi Plus and Handi Stop gas stations and convenience stores in Texas. According to the filing with the Maine AGO, Gulshan detected unauthorized access to its IT systems in late September.  An investigation showed that the attacker had access to the company’s systems for 10 days before being detected, gaining entry following a successful phishing attack. Before it was expelled from Gulshan’s network, the threat actor stole personal data and deployed ransomware that encrypted files on the company’s systems. The probe found that personal information such as names, contact details, SSNs, and driver’s license numbers was compromised. Advertisement. Scroll to continue reading. No known ransomware group has publicly claimed responsibility for the attack on Gulshan. While the absence of a leak site posting can sometimes suggest a ransom has been paid, Gulshan’s disclosure that it restored systems using “known-safe backups” typically indicates the company chose to rebuild rather than negotiate a payment. Related : Dozens of Major Data Breaches Linked to Single Threat Actor Related : NordVPN Denies Breach After Hacker Leaks Data Related : Brightspeed Investigating Cyberattack Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Meta Paid $78,000 Bounty for Vulnerability Exposing Customer Support Data Exploitation of ServiceNow Vulnerability Seen Days After Disclosure SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch New Index Tracks Material Breaches — And Refuses to Add Up the Losses WP2Shell WordPress Vulnerabilities Exploited in the Wild Two Scattered Spider Hackers Sentenced to Jail in UK ‘ClickLock Stealer’ Bypasses macOS Security With Social Engineering, Process Killing China’s Top Cybersecurity Firms Hit by Mounting Military Procurement Bans Fourth SharePoint Vulnerability Exploited in Past Month’s Wave of Attacks Endpoint Security Firm Glow Launches With $180M in Funding at $1.2B Valuation Oracle Patches Over 1,400 Vulnerabilities With Quarterly Security Updates Ransomware Group Threatening to Leak Data Stolen From Coca-Cola’s Fairlife OpenAI Says Its AI Models Broke Loose and Hacked Hugging Face Trump Orders Defense Contractors to Map Software, Suppliers Across Critical Supply Chains Cisco Launches Low-Cost AI Models for Source Code Security Empirical Security Raises $25 Million in Series A Funding Join this live webinar as we explore why exploitation is outpacing remediation, where risk is growing fastest, and what security leaders can do to close the gap before attackers take advantage. CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Jazz has named Sean Robinson, Rickie Goyal, Danielle Guetta, Shani Nago, and Lior Magram as VPs and Michael Calev as COO. AJ Shipley has been appointed Chief Product Officer at CrowdStrike.

Shadow Tier lists Jan 9, 2026 as the signal date.

Gulshanmgmt is the organization connected to this public signal.

This signal is connected to current ransomware incidents based on its reported incident context.

This signal is connected to data exposure and breach intelligence based on its reported consequences.