Gulshan Management Services Data Breach: 377,082 People

Massachusetts notice 2026-15 describes Gulshan Management Services as a business services company acting on behalf of its customers and says the investigation confirmed that an unauthorized third party may have accessed certain personal information.

The company says it reset credentials, rebuilt affected systems, installed additional threat-monitoring software, and notified law enforcement and regulators. Public documents do not disclose the precise start and end of access, the method used, or the responsible actor, so September 17 should not be treated as a confirmed first-access date.

The Texas Attorney General record lists names, addresses, Social Security numbers, driver's license numbers, government identification such as passports or state IDs, and financial information among the possible data types. The Massachusetts notice also identifies contact information and financial account numbers.

The information involved may have varied by person and by GMS customer. The full list should not be assumed to apply to every notice recipient or to have been accessed together; the broad contact-information label should not be expanded into a specific email or phone field.

The Indiana Attorney General's 2026 report records 377,082 affected people nationwide and 6,011 affected Indiana residents for this incident.

The 128,652 people in the Texas record are a large state-resident subset. The Indiana and Texas figures should not be added to the nationwide total.

A Social Security number, government identifier, or financial account number combined with a name and address can support identity theft, fraudulent credit applications, and account-fraud attempts.

An attacker may use an accurate contact or account detail to make a message impersonating GMS, an affiliated business, a bank, or a monitoring provider appear credible. An accurate detail does not prove that the sender is legitimate.

Notice recipients should regularly review financial account activity and credit reports and report transactions, accounts, or applications they do not recognize.

The official notice offers eligible recipients 24 months of credit monitoring, fraud consultation, and identity-theft restoration through Kroll. Use only the membership number and deadline in the letter sent directly to you.

Do not provide a Social Security number, account detail, password, or verification code during an unsolicited call or message. If help is needed, independently use the official contact channel in the notification letter instead of a link in the message.

The confirmed scope consists of possible unauthorized third-party access, personal information held in affected systems, recipient-variable identity, contact, and financial information, and 377,082 affected people. The exact access window, initial-access method, and responsible actor were not publicly disclosed.