Skip to Main Content

08/10/2026

Our systems are down as we are investigating a recent cybersecurity attack. We apologize for any inconvenience. Teams are working on a resolution and activating business resiliency plans. Learn more

TruStage is actively investigating a cybersecurity attack

We value your partnership and appreciate your patience. Please see below for further information.
00:00:16 - 00:05.44
Hello everyone. I want to take a few moments to address a couple of your top questions and

00:05:44 - 00:11:28
provide an update on where we are in our recovery efforts, the status of our data investigation,

00:11:28 - 00:17:92
including some estimated timelines for what you can expect from us in the coming days and weeks.

00:17:92 - 00:24:32
First, I want to more specifically address our system status and timeline for recovery.

00:24:32 - 00:31:44
So, on July 11th, there was a particularly broad attack on our network and systems. The incident

00:31:44 - 00:37:04
was contained and we can confirm that as we rebuild, we're ensuring there is no malicious

00:37:04 – 00:43:84
code or threat actor in our systems. Rebuilding parts of our infrastructure to bring systems back

00:43:84 - 00:50:24
safely rather than simply turning things back on was required based on the breadth and scope of

00:50:24 - 00:58:32
the event. Our goal is for us and for you to have confidence that as we bring things back online,

00:58:32 - 01:04:96
we've made sure they've they're protected, they're safe and they're stable. Now, we're in that

01:04:96 - 01:11:20
process of bringing systems and applications back online right now. And we're being deliberate and

01:11:20 - 01:18:00
diligent to ensure that we are doing everything we can to bring systems up with protecting employees,

01:18:00 - 01:24:32
partners, members and the organization. To ensure our environment remains safe,

01:24:32 - 01:31:84
we've refreshed workforce laptops and updated new security measures for our TruStage teams. Now,

01:31:84 - 01:37:68
that work is close to completion and was a necessary step to ensure that as teams start to

01:37:68 - 01:44:64
re-engage with our systems, we all know everything is safe. Our progress and momentum on restoration

01:44:64 - 01:51:20
continues. And based on what we know right now, we anticipate the majority of our key processes will

01:51:20 - 01:57:52
be operational by mid-August. While we've talked a lot about systems coming online, know they may

01:57:52 - 02:04:32
not be fully operational or fully back to normal. We recognize this process feels slower than any

02:04:32 - 02:10:72
of us would like and how frustrating that is for you and your members. That's why we continue to

02:10:72 - 02:17:68
create processes, workarounds or alternative paths to get to functional operational levels as quickly

02:17:68 - 02:24:48
as possible. Now, let me turn to the status of our data investigation. The reality is these

02:24:48 - 02:30:48
forensic investigations, they take time. It takes time to figure out whether anything was accessed

02:30:48 - 02:37:20
and to confirm what wasn't. And if information was accessed, it takes time to confirm what kind

02:37:20 - 02:45:04
of information it was, and where that data came from. Our expert cybersecurity partner Mandiant

02:45:04 - 02:51:76
and our internal teams are working diligently on that investigation as we speak. But just to set

02:51:76 - 02:58:24
expectations, these are not answers that come immediately in these kinds of events. You've

02:58:24 - 03:03:04
probably experienced that yourself if you've been notified of an incident involving your own

03:03:04 - 03:09:60
information. We don't know yet. But what I do know is that when I've received these notifications,

03:09:60 - 03:14:72
they typically come months after the actual event. And I know that can be

03:14:72 - 03:22:32
frustrating because you want answers about your members now. And while we don't know if credit

03:22:32 - 03:30:08
union member data was accessed, what I can tell you is that you will be the first to know if this

03:30:08 - 03:36:64
is the case and we'll work in partnership with you to ensure that any notification or reporting

03:36:64 - 03:43:52
process is as easy as possible. Finally, I'd like to talk about what you can expect from us going

03:43:52 - 03:51:04
forward. Right now, our teams remain relentlessly focused on restoring operations and serving our

03:51:04 - 03:57:20
partners, members and customers safely and securely. In the meantime, we're committed to

03:57:20 - 04:03:04
sharing regular email updates with you multiple times a week, and I'll continue to share what we

04:03:04 - 04:09:52
can, when I can. Within my email, you're going to find the latest details about how we're moving

04:09:52 - 04:16:96
closer to restoration and becoming more and more operational across the business. We know that you

04:16.96 - 04:22:32
and your teams are continuing to field questions and have hard conversations on a daily basis,

04:22:32 - 04:28:64
and we sincerely appreciate your partnership, your patience and the support from so many of you that

04:28:64 - 04:33:68
I've received. I recognize you're in a tough position and I appreciate all you're doing to

04:33:68 - 04:39:20
take care of customers and give them confidence in the path forward. So, on behalf of TruStage,

04:39.20 - 04:42:41
thank you again for everything you're doing, and I will talk to you soon.

What you should know

TruStage® continues to make progress in its recovery following the cybersecurity attack identified on July 11. Given the broad impact across our network and systems, we are rebuilding portions of our infrastructure to ensure services are restored safely and securely. This deliberate approach helps protect employees, partners, members, customers, and the organization as we bring systems and applications back online.

Your members can start a claim at trustage.com/startclaim.

You can still sell Credit Insurance, Debt Protection and GAP. See below for guidance or reach out to your Account Representative with specific questions.

Frequently asked questions

We understand you may have questions about this service disruption. Please review the latest updates and FAQs, which address many common questions.

Outage questions

  • You can review the technical FAQs of the cybersecurity incident at www.trustage.com/outage-info.

  • Because this was a particularly broad attack on our network and systems, we rebuilt parts of our infrastructure. We are now bringing systems and applications back online and anticipate that the majority of key processes will be operational by mid-August.

  • No. We are not encouraging, facilitating, or participating in efforts to replace, surrender, or discontinue in-force insurance coverage as a result of this incident or as part of our ongoing business recovery efforts.

  • At this stage, it would be premature to draw conclusions about the scope or impact of the incident, including whether any data may have been accessed. We do not want to speculate or get ahead of the facts and will provide additional information as we can.

  • We understand that situations like this can raise questions and concerns. As our understanding of the situation evolves, we will communicate appropriately.

  • Customers can visit www.trustage.com/outage/individual for the latest updates, resources and FAQs related to the service disruption. TruStage will continue to update available information as restoration efforts progress.

  • The NCUA is aware of this event. If your credit union determines it is a reportable event to the NCUA, the NCUA has informed us that it is sufficient to call or email the NCUA, provide your credit union name and inform them that you are reporting regarding the TruStage cybersecurity event. You can call the NCUA at 1-833-CYBERCU (1-833-292-3728) and leave a voicemail or email at cybercu@ncua.gov to accomplish that report.

For credit union leaders

  • If a policy was active or within an applicable grace period when the service disruption occurred, it will remain in that status while TruStage works to restore normal payment processing. Claims will continue to be evaluated and handled according to the terms and conditions of the policy. To support customers affected by the service disruption, TruStage is extending applicable grace periods. Additional information will be provided as normal servicing operations resume.

  • Depending on the timing of a customer's regularly scheduled premium payments, more than one premium payment may become due during the extended grace period. TruStage is evaluating customer payment scenarios as systems are restored and will communicate directly with affected customers regarding any actions required. Additional information will be provided as it becomes available.

  • TruStage representatives are available to receive customer inquiries and provide available guidance. However, some servicing and claims-related activities remain limited while systems are being restored. We are working diligently to restore systems and critical business processes and will provide updates as additional capabilities become available.

  • TruStage continues to evaluate the timing and approach for restoring marketing activities, including direct mail. Our current focus remains on fully restoring business operations and ensuring we can deliver a high-quality customer experience across all channels. As decisions are made regarding the resumption of marketing programs we will provide additional updates and communicate corresponding plans for lead fulfillment and support.

  • BenefitsForYou remains unavailable while systems are being safely restored. At this time, account balance and plan benefit information cannot be accessed through the platform. There has been no impact to annuity or retirement account balances or benefits as a result of the cybersecurity incident. We continue to restore systems in a controlled and secure manner and will provide updates as additional functionality becomes available.

  • TruStage is actively working to restore systems and critical business processes in a controlled and secure manner. Claims will be processed and paid in accordance with applicable policy terms and conditions as operational capabilities are restored. At this time, product-specific claim payment timelines are not available. We will continue to provide updates as additional information becomes available.

Product questions

    1. Yes! Through our partnership with Liberty Mutual and Polly, members can continue to receive Auto & Home insurance quotes, purchase coverage, service their policies, and access claims support without disruption.
    2. While the servicing experience remains largely unchanged, the member’s online experience may look different for now. We are continuing to refine that experience as systems and capabilities are restored.

  • Dedicated response teams are actively working to restore systems and support critical business processes.

    • Credit unions should continue gathering claim details and supporting documentation and file new claims via www.trustage.com/startclaim.
    • TruStage teams are actively engaging with members and credit unions to obtain needed information and advance claims through the process.
    • Updates will be shared as information becomes available.
    • Our priority remains minimizing disruption for credit unions and their members while restoring services safely and responsibly.

  • On July 29, TruStage initiated a temporary business continuity process for credit unions with members receiving previously approved recurring benefit payments. Payments will be issued as a lump sum and will generally reflect the prior month's recurring benefit payments, adjusted as needed for benefits that have ended. Because these payments will not include a member-level ledger, a member of the Claims team will contact participating credit unions directly to provide payment details and support appropriate distribution of funds.

  • TruStage is proactively initiating this process for credit unions that received six or more recurring member benefit payments during the previous month. Credit unions that do not meet this threshold but believe a member should have received a recurring benefit payment may contact the Claims team for review and evaluation.

  • For claims and servicing credit unions should continue collecting claim details and supporting documentation. TruStage teams are actively working to restore systems and provide ongoing guidance. Updates will be shared as information becomes available.

  • Yes, a limited MRC quoting workaround is available through Assurant's GLOW platform for a select group of high-volume credit unions.

    Key points:

    • GLOW can be used to generate MRC quotes and member pricing
    • GLOW is for quoting only and does not issue MRC contracts
    • Participation is limited due to implementation and support capacity
    • Selected credit unions will receive separate communications and implementation instructions

    Credit unions using GLOW can:

    • Generate MRC quotes based on vehicle information
    • Present pricing to members
    • Finance the MRC cost as part of the loan
    • Track MRC sales during the outage

    Once PAX is restored, credit unions must enter the sale into PAX and issue the official MRC certificate to the member.

  • Several temporary business continuity processes have been established to help credit unions continue serving members while systems are unavailable:

    For GAP:

    • Eligible PAX credit unions may use the approved GAP workaround
    • Credit unions should maintain documentation of all sales during the outage
    • Sales must be entered into PAX once service is restored

    For MRC:

    • Selected credit unions may use Assurant's GLOW platform to generate quotes
    • GLOW does not issue contracts
    • Credit unions must track all MRC sales completed during the outage and process them in PAX after restoration

    For GAP claims and servicing:

    • Credit unions should continue collecting claim details and supporting documentation
    • TruStage teams are actively working to restore systems and provide ongoing guidance
    • Updates will be shared as reliable information becomes available

Our priority remains minimizing disruption for credit unions and their members while restoring services safely and responsibly.

If you still have questions, please connect with your account representative.