After a chaotic week following the Justice Department’s mid-trial settlement with Live Nation-Ticketmaster, the antitrust trial picked back up surprisingly smoothly on Monday — this time, with dozens of states leading the case.
Technology
Ransomware attack exposes Social Security numbers at major gas station chain
NEWYou can now listen to Fox News articles!
Cybercriminals are happy to target almost any industry where data can be stolen. In many cases, less prepared and less security-focused companies are simply easier targets.
A recent ransomware attack on a company tied to dozens of gas stations across Texas shows exactly how this plays out. The incident exposed highly sensitive personal data, including Social Security numbers and driver’s license details, belonging to hundreds of thousands of people.
The breach went undetected for days, giving attackers ample time to move through internal systems and steal sensitive data. If you’ve ever paid at the pump or shopped inside one of these convenience stores, this is the kind of incident that should make you stop and pay attention.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.
What happened in the Gulshan ransomware attack
According to a disclosure filed with the Maine Attorney General’s Office, Gulshan Management Services, Inc. reported a cybersecurity incident that impacted more than 377,000 individuals. Gulshan is linked to Gulshan Enterprises, which operates around 150 Handi Plus and Handi Stop gas stations and convenience stores across Texas.
WINDOWS 10 USERS FACE RANSOMWARE NIGHTMARE AS MICROSOFT SUPPORT ENDS IN 2025 WORLDWIDE
The company says it detected unauthorized access to its IT systems in late September. Investigators later determined that attackers had been inside the network for roughly ten days before anyone noticed. The intrusion began with a phishing attack, a reminder of how a single deceptive email can still open the door to massive breaches.
Ransomware attacks don’t just hit tech companies. Retailers like gas stations store sensitive customer and employee data that criminals actively target. (Kurt “CyberGuy” Knutsson)
During that window, the attackers accessed and stole personal data, then deployed ransomware that encrypted files across Gulshan’s systems. The compromised information includes names, contact details, Social Security numbers and driver’s license numbers. That combination is especially dangerous, since it can be used for identity theft, account takeovers and fraud that may surface months or even years later.
Why the lack of a ransomware claim still matters
So far, no known ransomware group has publicly taken credit for the attack. That might sound like good news, but it does not necessarily change the risk for affected individuals. In many ransomware cases, silence can mean one of two things. Either the attackers have not yet posted stolen data publicly, or the victim company may have resolved the incident privately.
Gulshan’s filing states that it restored its systems using known-safe backups. That detail often suggests a company chose to rebuild rather than negotiate with attackers. Even so, once data has been copied out of a network, there is no way to pull it back. Whether or not the stolen information ever appears online, the exposure alone puts affected people at long-term risk.
This incident also highlights a recurring pattern. Retail and service businesses handle huge volumes of personal data but often rely on legacy systems and frontline employees who are prime phishing targets. Gas stations may not feel like obvious hacking targets, but their payment systems, loyalty programs and HR databases make them valuable all the same.
We reached out to Gulshan Management Services for comment regarding the breach, but did not receive a response before our deadline.
A customer pumps gas at a gas station on Feb. 13, 2025, in Austin, Texas. (Brandon Bell/Getty Images)
10 steps you can take to protect yourself after a breach like this
If your information was exposed in this breach or any similar ransomware incident, there are concrete steps you can take to reduce the fallout.
1) Monitor your credit and identity closely
If the company offers free credit monitoring or identity protection, enroll in it. These services can alert you early if someone tries to open accounts or misuse your identity. If nothing is offered, consider signing up for a reputable identity theft protection service on your own.
Identity Theft companies can monitor personal information like your Social Security Number (SSN), phone number, and email address and alert you if it is being sold on the dark web or being used to open an account. They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals.
See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com.
2) Consider a personal data removal service
The less of your information that’s floating around data broker sites, the harder it is for criminals to target you. Data removal services can help reduce your digital footprint over time.
While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.
Even when no ransomware group claims responsibility, stolen data can still fuel identity theft, fraud, and account takeovers long after a breach occurs. (Kurt “CyberGuy” Knutsson)
Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.
Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.
3) Use a password manager
A password manager helps you create and store unique passwords for every account. If attackers try to reuse stolen data to break into your online accounts, strong, unique passwords can stop that attempt cold.
Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.
FIBER BROADBAND GIANT INVESTIGATES BREACH AFFECTING 1M USERS
Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.
4) Turn on two-factor authentication (2FA) everywhere possible
2FA adds an extra barrier, even if someone has your personal details. Prioritize email, banking, cloud storage, and shopping accounts, since those are often targeted first.
5) Install and keep a strong antivirus software running
Strong antivirus software can help detect phishing attempts, malicious downloads, and suspicious activity before it turns into a full compromise. Keep real-time protection enabled and don’t ignore warnings.
The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.
Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.
6) Watch for phishing and follow-up scams
After breaches like this, scammers often send fake emails or texts pretending to be the affected company or a credit monitoring service. Slow down, verify messages independently, and never click links you weren’t expecting.
7) Review your credit reports regularly
Check your reports from all major credit bureaus for unfamiliar accounts or inquiries. You’re entitled to free reports, and catching issues early makes them much easier to fix.
8) Freeze your credit to stop new accounts from being opened
If criminals expose your Social Security number, place a credit freeze as soon as possible. A credit freeze blocks lenders from opening new accounts in your name, even when thieves have your personal details. The credit bureaus offer freezes for free, and you can temporarily lift one when you apply for credit yourself. This step stops identity theft before it starts, instead of alerting you after the damage is done. If you prefer not to freeze your credit, place a fraud alert instead. A fraud alert tells lenders to verify your identity before approving credit, which adds another layer of protection.
To learn more about how to do this, go to Cyberguy.com and search “How to freeze your credit.”
In the Gulshan attack, hackers spent days inside internal systems, stealing personal data before deploying ransomware that locked down files. (Silas Stein/picture alliance via Getty Images)
9) Protect yourself from tax refund fraud with an IRS Identity Protection PIN
When Social Security numbers are stolen, tax fraud often follows. Criminals can file fake tax returns in your name to steal refunds before you ever submit your paperwork. An IRS Identity Protection PIN (IP PIN) helps prevent this by ensuring only you can file a tax return using your SSN. It’s a simple but powerful safeguard that can block a common form of identity theft tied to data breaches.
10) Lock down existing bank and financial accounts
Don’t just watch for new fraud, proactively secure the accounts you already have. Enable alerts on bank and credit card accounts for large transactions, new payees, or changes to contact information. If your SSN or driver’s license number was exposed, consider calling your bank to ask about additional protections or account notes. Acting early can prevent small issues from becoming major financial problems.
Kurt’s key takeaway
Your personal data doesn’t just live with banks and hospitals. Retailers, gas stations, and convenience store operators also hold information that can cause real harm if it falls into the wrong hands. When attackers get in through something as simple as a phishing email and stay undetected for days, the damage can spread fast. You can’t prevent these breaches yourself, but you can limit how much power stolen data gives criminals by locking down your accounts and staying alert.
Do you think everyday businesses like gas stations take cybersecurity seriously enough? Let us know by writing to us at Cyberguy.com.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.
Copyright 2026 CyberGuy.com. All rights reserved.
This isn’t the outcome the states originally wanted. Out of concerns about being able to effectively take over the case and fear that the jury would be prejudiced by the shakeup, they requested a mistrial, which would have restarted the court battle at an unknown future date. But an irritated Judge Arun Subramanian seemed likely to deny the request, and once the states figured out how to retain the DOJ’s expert witness and were able to quickly hire up, they withdrew their mistrial motion. After the new faces were introduced, the trial restarted from roughly where it left off more than a week ago, with testimony that included how Live Nation deployed its “velvet hammer” against rivals.
Subramanian welcomed the jurors back from their “spring break” and asked if they had read or encountered any news about the case when they were out, which is forbidden by the jury instructions. They either shook their heads or remained silent. He reminded the jurors that the US had resolved its claims, as had a handful of states, but the rest were proceeding to trial. Jurors shouldn’t make any inferences from the fact those parties are no longer in the case, he said.
With the DOJ out of the picture, the lawyers who questioned early witnesses were gone, replaced by a new team co-led by Jonathan Hatch, an attorney from the New York AG’s office, and Jeffrey Kessler of Winston & Strawn, who represented college athletes in the landmark Supreme Court antitrust case against the NCAA over compensation.
The states’ attorneys picked up questioning of Jay Marciano, the COO of AEG, a competitor to Live Nation on multiple fronts. While Hatch refreshed jurors on parts of Marciano’s prior testimony, it was otherwise a fairly standard examination. Marciano testified about ticketing models he prefers in Europe, where multiple ticketing services often work at a venue, unlike the norm in the US where venues tend to accept exclusive ticketing contracts, often from Ticketmaster.
On cross examination, Marciano spoke to an incident the jury heard about early in the trial: a call between the Barclays Center’s then-CEO and Live Nation CEO Michael Rapino, who responded to an attempt to abandon Ticketmaster by saying it would be harder for the arena to get concerts with the new UBS Arena nearby. While Barclays interpreted this as a threat to protect Ticketmaster, Marciano affirmed that it’s common as a concert promoter to play venues against each other to get more favorable terms, and that the UBS Arena likely would attract artists away from Barclays as the new venue in town.
Live Nation’s president of US concerts, Robert Roux, addressed a separate allegation: that Live Nation uses its broad control over US amphitheaters to maintain its monopoly power, leaving no other real options for artists looking to play large outdoor venues. Through Live Nation’s own business presentations, plaintiff attorney Josh Hafenbrack demonstrated that the company made big strides to gain power over four of the top five amphitheaters in the US by ticket sales between 2016 and now. A 2018 presentation showed a largely highlighted list of the top 100 amps worldwide, with the green highlights representing the 62 Live Nation owned, operated, or exclusively booked venues at the time. Since then, Roux confirmed, the company has added several more on that list.
Live Nation denies it acted anticompetitively, and argues the states ignore other kinds of venues that compete for the same shows. But Roux wrote in a 2015 email that many non-superstar artists come in wanting to play amphitheaters — many of which, evidence shown in court has suggested, are controlled or exclusively booked by Live Nation. He also wrote that in those cases, there was “room for tighter negotiations and deals.”
“Either we are together or we are competitors”
Other emails described how Live Nation thinks about its competition when contemplating otherwise lucrative deals. In a 2018 email exchange, Rapino questioned why Live Nation should give shows to a promoter in the South it considered acquiring, Red Mountain Entertainment, before it actually owned it. Roux wrote at the time that the message to Red Mountain should be, “Either we are together or we are competitors.” He described the approach as a “velvet hammer.” On the witness stand, Roux said the message wasn’t meant to “antagonize” the promoter, but to be firm and send a clear message. In a separate exchange that mentioned Red Mountain, Roux wrote that Live Nation shouldn’t get “complacent” and “let small guys encroach from the edges.” Roux said the comment was a general one, and not specific to the promoter. Live Nation acquired Red Mountain in 2018.
In 2020, Rapino advised Roux against letting Radio Disney and concert promoter Superfly into a Live Nation venue, even after they offered a contract that would yield at least $400,000 in profit for Live Nation for renting out the amp. One executive had raised a concern about allowing a third-party promoter into the amp, even though the “money is great.”
Finally, Roux testified that Live Nation’s profits per fan have multiplied in recent years, with profitability in large amps, a key market in the case, growing more than other venue categories between 2019 and 2024. Before certain costs were factored in, the company made $386 million in profit from large amps in 2024, nearly triple the amount it made in that segment in 2019.
Besides the delay in the case while the states’ team sorted out its next moves absent the DOJ, there wasn’t a noticeable change in the flow of trial and how the new litigators operated, compared to the first week of trial. The case is still expected to run several more weeks, though both sides said they’ve worked to trim their witness lists to help make up for lost time. Toward the end of this week, one of the trial’s most high-profile witnesses is expected to take the stand: Live Nation’s CEO.
Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.
NEWYou can now listen to Fox News articles!
Every so often, we receive an email that stops us cold. Not because it is dramatic. Not because it is careless. Because it feels impossible.
Sheri M. from Georgia recently wrote to us with this question:
“Yesterday I learned that someone had stolen my debit card information. I was alerted by my bank about 10:00 p.m. last night that someone tried to use my card in Brazil. I am in the Southern United States and have never traveled outside the country. What I have trouble understanding is that this particular debit card has never been used and has never been out of a locked vault. It has been activated, and once activated, I locked it up. No one had access to it, no questions about that. It is just not possible. So how could someone have my card information? I asked this question at my bank, and after speaking to several people, they are at a loss as to what to tell me. I hope you can shed some light on this.”
GHOST-TAPPING SCAM TARGETS TAP-TO-PAY USERS
Debit card numbers can be compromised digitally through system breaches or automated number-guessing attacks. (fizkes/Getty Images)
Sheri, first, we are glad your bank flagged it. That alert tells you fraud monitoring worked. Now let’s address the part that feels unreal. How can someone use a debit card that has never left a locked vault?
If you have asked that same question, you are not alone. This type of debit card fraud happens more often than most people realize. And it almost never involves someone physically touching your card.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.
How debit card fraud happens without using the card
When a card is compromised without being used, the issue is typically digital. Here are the most likely explanations.
1) The number was exposed before you received it
Debit cards move through multiple systems before they reach your mailbox. Third-party vendors manufacture, encode and ship them. That means the card number exists in databases long before you open the envelope. If one of those systems is breached, criminals can obtain card numbers in bulk. They never need the physical card. They never need your home. In that case, it has nothing to do with your vault.
2) A BIN attack may be responsible
Every debit card starts with a bank identification number. Criminals use software to generate the remaining digits at high speed. They test thousands of combinations using small transactions or foreign authorizations to see which numbers work. This is known as a BIN attack. They are not stealing your specific card. They are guessing valid numbers mathematically. If your card was activated, even if it was never used, it becomes part of the pool that can be tested. A foreign attempt, like one in Brazil, is often a test authorization. It feels personal. In reality, it is automated.
WEB SKIMMING ATTACKS TARGET MAJOR PAYMENT NETWORKS
A customer completes a transaction at Pike Place Market in Seattle, Washington, on May 28, 2025. Financial security specialists recommend canceling compromised cards and monitoring accounts immediately after a fraud alert. (M. Scott Brauer/Bloomberg via Getty Images)
3) A processor or network weak point
Sometimes the exposure does not originate at the bank itself. The weak link can involve:
- A payment processor
- A card network
- A digital wallet backend
- A servicing vendor
Frontline bank employees often do not have visibility into these system-level issues. Patterns can take time to surface internally. That is why you may not receive a clear explanation right away.
4) Backend systems assign numbers early
Many banks pre-assign card numbers or connect them to digital systems before you ever swipe the card. If that backend data is exposed, the physical card remaining locked away does not matter. That is why debit card fraud without using the card can still occur.
Why did the transaction show up overseas?
You may wonder why the attempt came from Brazil. Foreign authorizations are often used as test transactions. Criminal groups run small or unusual location charges to see which numbers are active. If the charge clears, they escalate. The good news is your bank blocked it.
What you should do right now
If this happens to you, act quickly.
- Cancel the card completely. Do not just lock it. Make sure the number is permanently closed.
- Request a new card number. Confirm it is not a reissue of the same digits.
- Monitor your checking account daily for at least 30 days.
- Freeze your credit with all three credit bureaus.
- Add identity monitoring to detect broader misuse.
That final step is often overlooked.
WHY SCAMMERS OPEN BANK ACCOUNTS IN YOUR NAME
Experts say debit card fraud often occurs without the physical card ever being used or stolen. (Nikos Pekiaridis/NurPhoto via Getty Images)
Why identity monitoring matters
Debit card fraud can be isolated. It can also signal a larger data exposure.
If your card number surfaced through a breach or vendor leak, other personal details may be circulating too. Email addresses, phone numbers and Social Security numbers often appear together in stolen datasets. That is where early detection becomes critical.
Our top Identity Theft Protection recommendation monitors credit activity, financial accounts and dark web marketplaces for signs your identity is being misused. You receive fast alerts so you can respond before small incidents turn into larger problems.
Instead of waiting for a late-night fraud alert, you gain earlier visibility.
See my tips and best picks on Best Identity Theft Protection at Cyberguy.com.
Ways to stay safe from invisible debit card fraud
You cannot control global criminal networks. You can reduce your exposure.
- Keep debit cards locked in your banking app when not in use
- Turn on real-time transaction alerts
- Use credit cards for online purchases when possible
- Freeze your credit as a preventative step
- Avoid storing debit card details across multiple retail sites
- Use identity monitoring for broader protection
Layered security gives you more control.
Kurt’s key takeaways
Sheri’s experience feels impossible because she did everything right. The card never left the vault. It was never used. No one had access. Yet the number was still tested from across the world. That is the reality of today’s financial crime. It is automated, remote and system-driven.
If this can happen to a card locked in a vault, what does that say about how secure our financial system really is? Let us know by writing to us at Cyberguy.com.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.
Copyright 2026 CyberGuy.com. All rights reserved.
Sony’s upgraded PlayStation Spectral Super Resolution (PSSR) technology is rolling out to several titles on the PS5 Pro, including Cyberpunk 2077, Final Fantasy VII Rebirth, Silent Hill 2, and more. Digital Foundry got a chance to test some of them and found that the “new upscaler delivers the kind of upgrade we were looking for from PS5 Pro.” Problems with shimmering, flickering, and other visual artifacts have been addressed, and they said it now delivers crisper and more consistent in-game graphics.
This is the first upgrade we’ve seen from AMD and Sony’s combined Project Amethyst work on improving the effect of rendering a game at a lower resolution, then using AI trained on graphics to analyze each frame and upscale it, delivering improved quality on the same hardware without reducing the framerate. The upgraded PSSR is included with the latest PS5 system software update, which will start rolling out “in phases” on March 17th at 1AM ET, and Sony says its improvements will also improve AMD’s next FSR update when that rolls out.
Assassin’s Creed Shadows and Cyberpunk 2077 will also get a patch with the PSSR update in the “coming weeks,” while CrimsonDesert will adopt the tech when the game launches on March 19th, according to Sony. You can also toggle the updated tech on or off for PS5 Pro games not on this list that already support PSSR, though Sony notes that “results may vary by title.”
Idaho2 minutes ago
Temperatures surge across SW Idaho and Eastern Oregon this week
Illinois8 minutes ago
Driver found dead with gunshot wound after crash in Palatine, Illinois
Indiana14 minutes ago
2 wounded in shooting on Indy’s northeast side
Iowa20 minutes ago
17 classic restaurants in Iowa that still feed the state’s soul
Kansas26 minutes ago
Kansas City coffee shop celebrates KC Royals players competing for Team Italy with espresso specials
Florida1 year ago
Florida High School Football Rankings: Top 25 teams – Oct. 21
Oregon2 years ago
How old is Bo Nix? What to know about Oregon quarterback ahead of 2024 NFL Draft
Connecticut2 years ago
Cleary's 21 help Le Moyne down Central Connecticut State 69-64 in OT
Virginia2 years ago
99th annual Pony Swim held in Virginia
Indiana2 years ago
Indiana Members Credit Union announced as new anchor tenant at Bottleworks District
Politics6 hours ago
Minnesota bill would ban warrants allowing police to collect data from devices near a crime scene
World7 hours ago
Kallas says ‘no appetite’ to shift mandate of EU Hormuz naval mission
News7 hours ago
Trump predicts US will have ‘honour of taking Cuba’ amid power blackout
Videos12 hours ago
MTG on Trump’s Iran war: ‘Why would an American president do that?’
News17 hours ago
Video: Michael B. Jordan Celebrates Oscar Win at In-N-Out
-
Oklahoma1 week agoOSSAA unveils Class 6A-2A basketball state tournament brackets, schedule
-
Oklahoma3 days agoFamily rallies around Oklahoma father after head-on crash
-
Michigan1 week agoOperation BBQ Relief helping with Southwest Michigan tornado recovery
-
Southeast1 week ago‘90 Day Fiancé’ alum’s boyfriend on trial for attempted murder over wild ‘Boca Bash’ accusations
-
Nebraska4 days agoWildfire forces immediate evacuation order for Farnam residents
-
Health1 week agoAncient herb known as ‘nature’s Valium’ touted for improving sleep and anxiety
-
Business1 week agoCommentary: In two new court cases, judges find that AI does not have human intelligence
-
Technology1 week agoTime’s running out to get a free gift card when you preorder a new MacBook