TruStage is actively investigating a cybersecurity attack

TruStage continues to make progress restoring services through a deliberate, phased recovery approach. Because this incident affected a broad portion of the technology environment, systems and applications are being restored carefully to ensure they are secure, stable and validated before returning to service. Many critical capabilities have already been restored, and additional functionality continues to come online. While progress is being made every day, some capabilities will require additional time as recovery efforts continue. Recovery is increasingly moving from access to execution: more customers and members are reaching TruStage, more claims are moving through the process and more transactions are being completed. Some services continue to rely on interim or manual processes.

We continue working with outside experts to investigate the cyber attack to understand the full impact, including whether any information was accessed. If customer information is found to have been accessed, TruStage will notify anyone affected directly with next steps.

Mandiant updated its Investigation Memo on Oct. 9, 2026. Based on the forensic evidence reviewed to date, Mandiant states that TruStage's operating environment is clean, the incident is contained, and it has identified no indication of any active intrusion. Mandiant has not identified threat actor activity within the environments in scope since July 11, 2026. Systems and workstations are returned to service in the new environment only after being validated as clean and safe by Mandiant. Mandiant's investigation and TruStage's recovery efforts remain ongoing.

As we continue to learn more, updates will be posted on this outage page.