MalwareProfessional ServicesProfessional ServicesPhishingRansomwareData EncryptedData ExfiltratedTargetedIdentity (basic)Government IDCriticalContained

Gulshan Management Services

bd_217671fec1634ed9 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Sep 27, 2025

Filed

Jan 6, 2026

To disclose

14 weeks

Affected · nationwide

377,08254 in this filing

Linked

10 filings

Confidence

66%

Full breach record for Gulshan Management Services →

Gulshan Management Services, Inc. reported a data breach affecting 377,082 individuals, including 54 Maine residents. The incident involved a phishing attack on September 17, 2025, leading to unauthorized access and deployment of malicious software that encrypted portions of the network. Compromised data included names, contact info, SSNs, and driver's license numbers. GMS contained the incident, rebuilt systems, and offered 12 months of Kroll identity monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Sep 27, 2025 → Filed with AG Jan 6, 2026101d ✗ ME AG >90d14 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 10 days

discovery → filing · 14 weeks / 101 days

Sep 17, 2025

Begins

Sep 27, 2025

Discovered

Jan 6, 2026

Filed

vs. sector median

4 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Iowa State AGbd_24f2f711ac332f952026-01-06Verified
South Carolina State AGbd_62380f5de3719fcb2026-01-06Verified
Massachusetts State AGbd_b665797329b8e3ce2026-01-06Verified
Vermont State AGbd_4d1d56b0a51c0c712026-01-05 · +1dVerified

Show 5 more filings ↓up to 69d gap

Indiana State AGbd_78a97382f455f0912026-01-05 · +1dCandidate
Nebraska State AGbd_803e9bb6b7a2af0a2026-01-05 · +1dVerified
New Hampshire State AGbd_a465700a822b3c122026-01-05 · +1dVerified
Illinois State AGbd_d28b44efa5b75e472026-01-01 · +5dVerified
Texas State AGbd_98d92f168972093a2026-03-16 · +69dVerified

Name: Gulshan Management Services
norm: gulshan management

Name: Gulshan Management Services
norm: gulshan management
Industry: Professional Servicesllm

Discovered: Sep 27, 2025
Breach occurred: Sep 17, 2025 – Sep 27, 2025
Undetected for: 10 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 5, 2026
Affected individuals: 377,082state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified regulatory authorities in relevant jurisdictions
Initial access: phishing_link

During the incident: Took immediate efforts to contain and remediate the incident
Expelled the third party from GMS’s systems
Brought systems back online using known-safe backups
Reset all access credentials to affected networks and systems
Completely rebuilt its compromised systems
Installed additional threat-monitoring software
Introduced more stringent access requirements for privileged accounts
Notified law enforcement and regulatory authorities in relevant jurisdictions
Changes made: Implemented measures to secure its affected systems
Reset all access credentials to affected networks and systems
Completely rebuilt its compromised systems
Installed additional threat-monitoring software
Introduced more stringent access requirements for privileged accounts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(101 days from discovery to filing)
Compliance flags: ME AG >90d · 101dME resident >60d · 100d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Sep 27, 2025
→ Filed with AG: Jan 6, 2026
101d 90 days ME AG >90d
Maine
Discovered: Sep 27, 2025
→ Notified: Jan 5, 2026
100d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Sep 27, 2025 → Filed with AG: Jan 6, 2026	101d	90 days	ME AG >90d
Maine	Discovered: Sep 27, 2025 → Notified: Jan 5, 2026	100d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Illinois State AGJan 1 · first

Vermont State AG+4d

Indiana State AG+4d

Nebraska State AG+4d

New Hampshire State AG+4d

Iowa State AG+5d

South Carolina State AG+5d

Massachusetts State AG+5d

Maine State AG+5d · this page

Texas State AG+74d

Pattern: first filing Jan 1 (IL), last Mar 16 (TX) — a 74-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/f697cde0-79d1-48bd-99f0-23db695fc166.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 6, 2026
Raw hash: 7eea5727a7ceb40c5e0422dea34e269ddc38fa0b9d44ebaa92c8ae764ba1f70a

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityGulshan Management Services

Victim entityGulshan Management Services

Incidentdiscovered Sep 27, 2025

Stated responseTook immediate efforts to contain and remediate the incident

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov