United States House of Representatives

Summary

A ransomware attack on a Texas-based gas station and convenience store operator compromised the personal data of more than 377,000 individuals, including names, contact details, Social Security numbers, and driver's license numbers. The intrusion began with a phishing email that gave attackers access to the company's network, where they spent roughly ten days undetected exfiltrating sensitive information before deploying ransomware that encrypted files across internal systems. The company, which operates around 150 locations under the Handi Plus and Handi Stop brands, later restored its systems using known-safe backups rather than negotiating with the attackers. No ransomware group has publicly claimed responsibility for the incident.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In late September, Gulshan Management Services, Inc., a company affiliated with Gulshan Enterprises, which operates approximately 150 Handi Plus and Handi Stop gas stations and convenience stores across Texas, detected unauthorized access to its IT systems. Investigators later determined that the intrusion had begun roughly ten days earlier, giving attackers an extended window inside the network before the breach was identified. The initial point of compromise was a phishing attack, in which a deceptive email was used to gain a foothold in the organization's environment. During the period of undetected access, the attackers moved through internal systems and exfiltrated personal data belonging to more than 377,000 individuals. Following the data theft, the attackers deployed ransomware that encrypted files across Gulshan's systems, compounding the impact of the intrusion.

The compromised information included names, contact details, Social Security numbers, and driver's license numbers. This combination of data elements created significant exposure for affected individuals, as it can be used for identity theft, account takeovers, and various forms of fraud that may surface long after the original breach. A disclosure filed with the Maine Attorney General's Office documented the scale of the incident, reporting that more than 377,000 people were impacted by the cybersecurity event at Gulshan Management Services. The company did not publicly identify the ransomware group responsible for the attack, and no known threat actor claimed credit for the incident at the time of the disclosure. In its filing, Gulshan stated that it had restored its systems using known-safe backups, indicating that the organization rebuilt its environment rather than negotiating with the attackers. Once the data was copied out of the network, there was no technical means to retrieve it, leaving affected individuals at long-term risk regardless of whether the stolen information was ever published online.

Sources

Sources available to members: 1 source.