TruStage is actively investigating a cybersecurity attack

TruStage continues to make progress restoring services through a deliberate, phased recovery approach. Because this incident affected a broad portion of the technology environment, systems and applications are being restored carefully to ensure they are secure, stable and validated before returning to service. Many critical capabilities have already been restored, and additional functionality continues to come online. While progress is being made every day, some capabilities will require additional time as recovery efforts continue. Recovery is increasingly moving from access to execution: more customers and members are reaching TruStage, more claims are moving through the process and more transactions are being completed. Some services continue to rely on interim or manual processes.

TruStage continues to conduct a comprehensive forensic and data-impact analysis with the assistance of external cybersecurity experts. Determining whether any information was accessed and understanding the scope of any potential impact requires extensive investigation and validation. Because of the complexity of this process, the analysis is expected to take additional time. If TruStage determines that notifications are required, those communications will be made through the appropriate channels.

Mandiant updated its Investigation Memo on Aug. 27 to reflect the latest forensic evidence reviewed. Based on its investigation, Mandiant has found no evidence of threat actor activity in the affected environments since July 11, 2026, when TruStage identified the incident and took action to contain and remediate it.

We understand that situations like this can raise questions and concerns. As our understanding of the situation evolves, we will communicate appropriately.