Gulshan Management Services Hit by Phishing Attack, Exposing Sensitive Data of Over 128,000 Gulshan Management Services, Inc., a Texas-based operator of approximately 150 gas stations and convenience stores under brands like Handi Plus, Handi Stop, Shell, and ExxonMobil—as well as fast-food franchises including Burger King, Wendy’s, and Sonic—suffered a significant data breach in September 2025. The incident, discovered on September 27, 2025, stemmed from a phishing attack on September 17, during which unauthorized actors accessed company servers, deployed ransomware, and encrypted portions of Gulshan’s network. The breach exposed sensitive personally identifiable information (PII) of consumers, including names, contact details, Social Security numbers, and driver’s license numbers. Gulshan reported the incident to the Texas Attorney General’s office on January 5, 2026, and the Vermont Attorney General’s office the following day, confirming that 128,652 Texas residents alone were affected. In response, the company offered free identity and credit monitoring services through Kroll, including fraud alerts and identity theft restoration support. Legal firms, including Shamis & Gentile P.A., are investigating potential compensation claims for impacted individuals. The breach highlights the ongoing risks of phishing attacks and the far-reaching consequences of compromised corporate systems in the retail and franchise sectors.

Gulshan Management Services Reports Data Breach Affecting Sensitive Personal Information Gulshan Management Services, Inc., a Texas-based gas station and convenience store operator, has disclosed a data breach to the Texas Attorney General’s office. The incident, reported on January 6, 2025, involved unauthorized access to sensitive personal identifiable information (PII) stored in the company’s systems. Gulshan, founded in 1976, manages nearly 150 locations under brands including Handi Plus, Handi Stop, Shell, and ExxonMobil, employing over 200 individuals. While the exact number of affected individuals remains undetermined, the exposed data may include financial information (such as credit/debit card numbers), government-issued IDs (e.g., passports or state IDs), and other personal details. As of the report’s filing, Gulshan had not yet begun notifying impacted individuals. The breach was documented in a filing with the Texas Attorney General, though further details about the incident’s scope or timeline have not been publicly released. The company is headquartered in Sugar Land, Texas.