Gulshan Management Services, Inc.

Summary

Gulshan Management Services, Inc., which operates Handi Plus and Handi Stop gas stations, detected unauthorized access to its IT systems following a phishing attack that allowed an intruder to remain inside for ten days before discovery. During that period the attacker exfiltrated personal data including names, Social Security numbers, contact details and driver’s license numbers for approximately 377,000 individuals and deployed ransomware that encrypted files. The company restored operations using known-safe backups and did not pay a ransom, later notifying affected customers and offering a year of identity monitoring while facing criticism for the delayed disclosure.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Gulshan Management Services, Inc., which operates approximately 150 Handi Plus and Handi Stop gas stations and convenience stores, detected unauthorized access to its IT systems in late September 2025. An investigation determined that the attacker gained entry through a successful phishing attack and remained undetected for ten days. During this period, the threat actor moved laterally within the network and accessed databases containing customer information. The compromised data included names, social security numbers, contact details, and driver’s license numbers.

Before being expelled, the attacker deployed ransomware that encrypted portions of Gulshan’s IT estate and exfiltrated the personal data of 377,082 individuals. The company did not disclose the breach to affected customers until several months later, when it began sending breach notifications. Gulshan offered impacted individuals a standard year of identity monitoring services as part of its response. The Maine Attorney General’s Office filing confirmed that more than 377,000 individuals were affected by the incident. No ransomware group has publicly claimed responsibility for the attack.

To restore operations, Gulshan relied on known-safe backups to rebuild its systems, indicating that it did not pay a ransom to the attackers. The law firm Schubert Jonckheer and Kolbe has stated that the delayed notification likely violated state and federal data breach laws. The firm is preparing a class action lawsuit on behalf of those who received breach notices and is encouraging affected individuals to join. Gulshan continues to manage its Handi Plus and Handi Stop locations while addressing the aftermath of the incident.

Sources

Sources available to members: 2 sources.