TruStage is actively investigating a cybersecurity attack

TruStage continues to make progress restoring services through a deliberate, phased recovery approach. Because this incident affected a broad portion of the technology environment, systems and applications are being restored carefully to ensure they are secure, stable and validated before returning to service. Many critical capabilities have already been restored, and additional functionality continues to come online. While progress is being made every day, some capabilities will require additional time as recovery efforts continue. Recovery is increasingly moving from access to execution: more customers and members are reaching TruStage, more claims are moving through the process and more transactions are being completed. Some services continue to rely on interim or manual processes.

We continue working with outside experts to investigate the cyber attack to understand the full impact, including whether any information was accessed. If customer information is found to have been accessed, TruStage will notify anyone affected directly with next steps.

Mandiant updated its Investigation Memo on Aug. 27 to reflect the latest forensic evidence reviewed. Based on its investigation, Mandiant has found no evidence of threat actor activity in the affected environments since July 11, 2026, when TruStage identified the incident and took action to contain and remediate it.

As we continue to learn more, updates will be posted on this outage page.