Gulshan Management Services data breach: phishing, then ransomware, 377,082 people

What happened at Gulshan Management Services?

The letter filed in Vermont gives the sequence. GMS found on the weekend of September 27, 2025 that an unauthorized third party had got into its systems, and the investigation traced the entry to a successful phishing attack on September 17, 2025. The third party reached servers that hosted personal data and deployed malicious software that encrypted portions of the network. GMS says it brought its systems back online from known-safe backups.

Afterwards it reset all access credentials, rebuilt the compromised systems, added threat-monitoring software and tightened access for privileged accounts. It notified law enforcement and regulators.

Date	What happened	Source
September 17, 2025	Phishing attack gives the intruder access	Vermont letter; Indiana report
Weekend of September 27, 2025	GMS discovers the access; part of the network is encrypted	Vermont letter
January 5, 2026	Notice date (377,082 in total)	Indiana report; Vermont filing
January 6, 2026	Logged in Massachusetts (8,750 residents)	Massachusetts report
January 9, 2026	SecurityWeek reports the Maine filing	SecurityWeek
March 16, 2026	Posted by Texas (128,652 Texans)	Texas report

Notice went out 110 days after the phishing attack and 100 days after GMS found the intruder. The notice-delay guide shows how that compares.

Was the Gulshan breach ransomware?

The letter describes ransomware without using the word: malicious software that encrypted portions of the network, followed by a restore from backups. It does not mention a ransom demand. SecurityWeek reported on January 9, 2026 that no known ransomware group had publicly claimed the attack. The intruder had about ten days inside before it was found.

Why did I get a letter from Gulshan Management Services?

GMS describes itself as a business services company and says it is writing on behalf of its customers. SecurityWeek reported that GMS appears to be associated with Gulshan Enterprises, which manages about 150 Handi Plus and Handi Stop gas stations and convenience stores in Texas. The letters do not name the customers, so a letter can come from a company you never dealt with, about one you did. The guide to letters from companies you never dealt with explains how that happens.

What information was exposed?

There are two versions of the letter. The one filed in Massachusetts lists names, contact information, Social Security numbers, financial account numbers and driver's license numbers. The version filed in Vermont lists the same items without financial account numbers. Massachusetts' record also marks medical records as breached, which neither letter mentions. Texas lists government-issued ID numbers and financial information.

How many people were affected?

Regulator	What it counts	Number
Indiana attorney general	Total affected	377,082
Texas attorney general	Texans	128,652
Massachusetts consumer affairs office	Massachusetts residents	8,750
Indiana attorney general	Indiana residents	6,011

Its total is the 24th largest of the 1,301 rows in Indiana's 2026 report; the largest data breaches of 2026 ranks the rest.

What is GMS offering?

Twelve months of Kroll identity monitoring at no cost, with credit monitoring, fraud consultation and identity theft restoration. Activation is at enroll.krollmonitoring.com with the membership number on the letter, by a deadline printed on each letter.

Item	Detail from the letter
Provider	Kroll
Length	12 months
Enrollment	enroll.krollmonitoring.com, with the membership number
Questions	(844) 574-1257, Monday to Friday, 8:00 a.m. to 5:30 p.m. Central Time, excluding major U.S. holidays

The letter also suggests changing passwords, turning on two-factor authentication on financial accounts, and placing a fraud alert or credit freeze. A freeze is free at each of the three bureaus and, unlike the monitoring, does not expire after a year; the guide to credit monitoring offers explains the difference.

What the documents leave open

• Which customers' data GMS held; the letters name none of them.
• Whether any ransom was demanded or paid.
• Why one version of the letter lists financial account numbers and the other does not, and why Massachusetts marks medical records as breached.