Credit union recovery updates and available support

Please review the technical FAQs of the cybersecurity incident by visiting trustage.com/investigation-faqs.

TruStage continues to make progress restoring services through a deliberate, phased recovery approach. Because this incident affected a broad portion of the technology environment, systems and applications are being restored carefully to ensure they are secure, stable and validated before returning to service. Many critical capabilities have already been restored, and additional functionality continues to come online. While progress is being made every day, some capabilities will require additional time as recovery efforts continue. Recovery is increasingly moving from access to execution: more customers and members are reaching TruStage, more claims are moving through the process and more transactions are being completed. Some services continue to rely on interim or manual processes.

Mandiant updated its Investigation Memo on Oct. 9, 2026. Based on the forensic evidence reviewed to date, Mandiant states that TruStage’s operating environment is clean, the incident is contained, and it has identified no indication of any active intrusion. Mandiant has not identified threat actor activity within the environments in scope since July 11, 2026. Systems and workstations are returned to service in the new environment only after being validated as clean and safe by Mandiant. Mandiant’s investigation and TruStage’s recovery efforts remain ongoing.

No. We are not encouraging, facilitating, or participating in efforts to replace, surrender, or discontinue in-force insurance coverage as a result of this incident or as part of our ongoing business recovery efforts.

We continue working with outside experts to investigate the cyber attack to understand the full impact, including whether any information was accessed. If customer information is found to have been accessed, TruStage will notify anyone affected directly with next steps.

As we continue to learn more, updates will be posted on this outage page.

Customers can visit trustage.com/outage/individual for the latest updates, resources and FAQs related to the service disruption. TruStage will continue to update available information as restoration efforts progress.

The credit union and individual outage pages now include FAQ search capabilities. The Retirement Solutions resource site has also been expanded with streamlined navigation by role, plan and category and can be reached through the Retirement Solutions outage page.

The NCUA is aware of this event. If your credit union determines it is a reportable event to the NCUA, the NCUA has informed us that it is sufficient to call or email the NCUA, provide your credit union name and inform them that you are reporting regarding the TruStage cybersecurity event. You can call the NCUA at 1-833-CYBERCU (1-833-292-3728) and leave a voicemail or email at cybercu@ncua.gov to accomplish that report.

The investigation remains ongoing, supported by Mandiant and Epiq Global. If we determine that member, employee, or other affected data has been impacted, credit unions will hear that information directly from us first — with the intent to provide the time to sufficiently partner with you on any communication we may need to do. We also remain committed to supporting you through any notification or reporting requirements and making that process as straightforward as possible.

Customers calling with billing questions can receive more informed support because contact center representatives have access to additional billing history.

TruStage can identify premiums that may have been collected in error during continuity operations. Teams are reviewing affected policies and determining where refunds are appropriate.

TruStage resumed mailing AD&D paper bills the last week in October, and our regular mailings of paper bills for those not on recurring ACH or recurring credit card automatic payments for their AD&D policy will continue going forward. To submit a payment by mail, the member should include their policy number on the check or money order. Mailing addresses for payments can be found at trustage.com/outage/individual/payments. Some standard sections of the bill may refer to the option of automatic payment set up and online policy management. We are working to restore these services, but currently customers should mail in a check for their premium payment.

The process to complete Life policy surrender requests is active, and TruStage has begun working through the backlog. Customers seeking a surrender should use the applicable form and submission instructions on the outage page. Requests may take longer than normal while the backlog is processed. At this time, customers who need to make changes to their policy (address change, beneficiary change, etc.), or who wish to cancel their policy, should follow the instructions on the applicable form found on the TruStage outage page for individuals: trustage.com/outage/individual/service-forms. For many customer service transactions, the form must be submitted by mail. This helps ensure forms and supporting documentation are received through a controlled process with the necessary customer authorization. For policyholders needing to file a claim, they can submit first notice of loss online at trustage.com/startclaim which routes to our Claims team for processing. The process to complete Life policy surrender requests is now active, and TruStage has begun working through the backlog. Customers seeking a surrender should use the applicable form and submission instructions on the outage page. Requests may take longer than normal while the backlog is processed.

Submitting forms by mail helps ensure information and supporting documentation are received through a controlled process with the necessary customer authorization. This process also helps support appropriate security, privacy, and record-retention requirements while recovery efforts continue.

We have reviewed alternative channels, including email, fax, and online upload; however, due to sensitive payment information or other restricted consumer information, the appropriate security, privacy, authentication, and retention controls must first be in place and approved. Until then, customers should follow the submission instructions on their form or the service communication they received.

For certain products, limited phone-based transaction support may be available. Customers should contact the appropriate service team to understand what capabilities are currently available for their product.

Yes. Teams are continually evaluating whether additional channels can be made available for consumers in a way that meets security, operational, compliance, and customer experience expectations. Restricted information and sensitive payment data remain key considerations before any upload, email, fax, or other digital submission option can be approved for use.

Claims processing and payment activity continue to expand. More Life claims are moving toward payment as access to beneficiary and benefit information improves, while substantial inventories remain and many customers continue to experience delays. Progress remains slower for AD&D claims because some information needed to review claims is not yet available through current processes. Digital First Notice of Loss improvements are capturing more information upfront, and Lending claim submission includes expanded digital capabilities.

1. Customers can report a new claim online, provide claim-related information or receive guidance on next steps. If a claim has already been submitted, they should not file a duplicate claim.
2. Customer support is available. TruStage representatives are available to receive customer inquiries and provide available guidance.
3. Some claims activities remain limited. Some servicing and claims-related activities remain limited while systems are being restored.
4. Claims will be processed as capabilities are restored. Claims will be processed and paid in accordance with applicable policy terms and conditions as operational capabilities are restored. At this time, product-specific claim payment timelines are not available.

We will continue to provide updates as additional information becomes available.

While claims processing capabilities continue to expand, even under normal operations some individual claims may be more complex and require different levels of review, documentation, validation, or investigation. Because of these differences, TruStage cannot provide claim-specific payment timelines.

If a member requested changes to their policy during the outage, those requests may not yet be reflected in current billing activity. As systems and servicing capabilities continue to be restored, TruStage will process requests and honor them based on the date they were received.

Members who cancel coverage will be removed from automatic recurring billing. Because there is currently a processing backlog, there may be a period between receipt of the cancellation request and removal from the billing file, during which an additional billing attempt could occur. If this happens, TruStage will refund the premium, and cancellation requests will be honored for the date the request was received.

If a policy was active or within an applicable grace period when the service disruption occurred, it will remain in that status while TruStage works to restore normal payment processing. Claims will continue to be evaluated and handled according to the terms and conditions of the policy. To support customers affected by the service disruption, TruStage is extending applicable grace periods. Additional information will be provided as normal servicing operations resume.

Depending on the timing of a customer's regularly scheduled premium payments, more than one premium payment may become due during the extended grace period. TruStage is evaluating customer payment scenarios as systems are restored and will communicate directly with affected customers regarding any actions required. Additional information will be provided as it becomes available.

BenefitsForYou remains stable following its initial participant launch, with digital access expanding to plan sponsors, advisors and third-party administrators. Contribution and withdrawal backlogs continue, although retirement account data has become more current as processing catches up. Broader transaction capabilities will return in subsequent phases.

TruStage previously resumed recurring monthly ACH and credit card payments for AD&D and Life policies, and we are resuming AD&D paper bill mailings in late October. We will continue to process inbound correspondence and deposit and apply checks as they are received. Some payment capabilities remain unavailable, including one-time payments by phone for Life and AD&D policies and other billing functions. Customers will not lose coverage due to an inability to make a payment during the service disruption, and applicable grace period accommodation remains in place. Additional capabilities will continue to come online as systems and processes are tested and validated.

One of the most common concerns we've heard from customers throughout this disruption has been their ability to make premium payments and maintain coverage. Restoring billing capabilities helps address that concern and provides reassurance that coverage remains in force while recovery efforts continue.

No. Billing restoration is one step in a broader recovery effort. We continue to restore systems and capabilities as they are tested, validated and ready.

As systems and processes continue to come back online, some customers may experience delays, processing exceptions or other service-related issues. Teams are monitoring performance closely and working to identify and address issues as quickly as possible.

• Digital FNOL (First Notice of Loss) is TruStage's online claim submission experience that allows credit unions to report claims electronically.
• The enhanced experience captures more information upfront, helping Claims obtain the details needed to begin adjudication while reducing follow-up requests for missing information.

No. The Digital FNOL enhancements were deployed to the existing FNOL link. Credit unions can continue using the same claim reporting link they have used previously.

• More claim information is captured during initial submission.
• Fewer follow-ups may be needed to gather missing details.
• Users can submit multiple FNOLs without repeatedly entering the same credit union information.
• Claims may be able to begin processing more efficiently because more complete information is received upfront.

• Yes. The Digital FNOL form is the official TruStage claim submission experience.
• In addition, the form is designed to limit the collection of sensitive information. For example:
  • Social Security Numbers should not be entered.
  • Full account numbers should not be entered.
  • Full loan numbers should not be entered.
  • The form only requests and accepts the last four digits of account and loan numbers.
• These controls help ensure only the information necessary to initiate the claim is submitted.

• Users should follow the prompts within the form and provide the information requested to report the claim.
• The form is intentionally designed to collect only the information needed to initiate the claim and support the adjudication process.

Yes. The enhanced experience includes bulk submission functionality that allows users to submit multiple FNOLs without repeatedly entering the same credit union information.

Possibly. While the enhanced form is intended to reduce follow-up requests by gathering more complete information upfront, Claims may still reach out if additional documentation, clarification, or claim-specific information is needed.

• Credit unions can use the Digital FNOL experience to submit all Credit Insurance, Debt Protection, and GAP loss types.
• One FNOL form is used for all CI and DP claim types.
• A separate FNOL form is used for all GAP claim types.

Credit unions and lending partners are beginning to regain capabilities used to enroll and transact through product APIs and the PAX interface, with pilot and partner testing beginning through a phased rollout. Impacted partners will receive information about timing, reactivation and any necessary steps as capabilities become available.

Credit unions can submit Lending claims in bulk through an expanded digital intake experience. A member-facing form captures more complete information upfront, reducing manual handling and follow-up outreach.

Dedicated response teams are actively working to restore systems and support critical business processes.

• Credit unions should continue gathering claim details and supporting documentation and submit new claims through the approved claim-start process at trustage.com/startclaim.
• TruStage teams are actively engaging with members and credit unions to obtain needed information and advance claims through the process.
• Updates will be shared as information becomes available.
• Our priority remains minimizing disruption for credit unions and their members while restoring services safely and responsibly.

If your data processor typically submits your monthly files to TruStage, no action is required at this time. TruStage is working directly with data processors and has asked them to hold monthly files until systems are available to receive and process them.

Credit unions that submit monthly files directly to TruStage should retain those files and hold them until TruStage confirms that file receipt and processing capabilities have been restored. Additional instructions will be provided when submissions can resume.

Yes. A First Notice of Loss (FNOL) process is available and TruStage is actively restoring claims payment capabilities. Please work with your account team for the latest protection product updates.

No, credit unions support member level cancellation of CI/DP.  Refunds are not normally required with cancellations as premium/fees are charged in arrears.  After a cancellation occurs, premium/fees are not charged going forward. 

If a refund is required for any reason, credit unions can provide the member refund and submit to TruStage when systems become available. 

TruStage has implemented a temporary business continuity process to help minimize disruption for members receiving previously approved recurring Debt Protection benefits. Payments are being prioritized for credit unions with the highest volume of approved recurring benefits and will continue to expand as recovery efforts progress. Credit unions with questions about specific member situations should contact the Claims team for assistance.

Continue to obtain your monthly premium reports from your data processing system as you normally would. However, those reports should be retained and held until TruStage advises that reporting and processing systems are available. At that time, additional instructions will be provided if needed.

No. Credit union products will not be canceled for non-payment during the current service disruption. Credit unions should retain their reporting information and await further guidance from TruStage regarding submission and processing.

TruStage is developing processes for both GAP and MRC to capture workaround data and issue member contracts. Additional details about the processes and timing will be shared as they become available.

Several temporary business continuity processes have been established to help credit unions continue serving members while systems are unavailable:

For GAP:

• Eligible PAX credit unions may use the approved GAP workaround
• Credit unions should maintain documentation of all sales during the outage
• Sales must be entered into PAX once service is restored

For MRC:

• Selected credit unions may use Assurant's GLOW platform to generate quotes
• GLOW does not issue contracts
• Credit unions must track all MRC sales completed during the outage and process them in PAX after restoration

For GAP claims and servicing:

• Credit unions should continue collecting claim details and supporting documentation
• TruStage teams are actively working to restore systems and provide ongoing guidance
• Updates will be shared as reliable information becomes available

Yes. GAP waivers and MRC certificates issued in accordance with TruStage’s approved outage procedures will be honored. TruStage is developing processes for both GAP and MRC to capture workaround data and issue member contracts. Additional details about the processes and timing will be shared as they become available.

If a member exceeds the number of skipped payments permitted under their GAP contract due to delays in Credit Insurance/Debt Protection (CI/DP) claims processing caused by the system outage, TruStage will account for those additional skipped payments when calculating the Protected Balance on a future GAP claim for a total loss.

Members may exceed the maximum number of skipped payments stated in their GAP contract by up to the number of months the outage continues. For example, if the outage lasts three months, TruStage will allow up to three additional skipped payments beyond the contract limit to be included in the Protected Balance calculation.

Until systems are back up and running, credit unions should proceed, accept, and release their letters of guarantee on total loss settlements during this outage so there isn’t a delay of any part of the total loss process for credit unions or their members.   

Once our systems are back online and the GAP claim is adjudicated, credit unions (and members) will not be penalized by TruStage for releasing the letter of guarantee during the system outage as described above. 

We will extend the qualifying time for the Plus benefit to correspond with the length of our outage. For example, if our inability to administer/pay Plus claims is 60 days, we'll extend the timeframe to file a Plus claim to 180 days. 

For claims and servicing credit unions should continue collecting claim details and supporting documentation. TruStage teams are actively working to restore systems and provide ongoing guidance. Updates will be shared as information becomes available.

Yes, there is no change to our MRC claims process. Members should work with a repair facility, which can submit claims directly to Assurant for review and payment. Assurant can pay the repair facility directly.

Yes, a limited MRC quoting workaround is available through Assurant's GLOW platform for a select group of high-volume credit unions.

Key points:

• GLOW can be used to generate MRC quotes and member pricing
• GLOW is for quoting only and does not issue MRC contracts
• Participation is limited due to implementation and support capacity
• Selected credit unions will receive separate communications and implementation instructions

Credit unions using GLOW can:

• Generate MRC quotes based on vehicle information
• Present pricing to members
• Finance the MRC cost as part of the loan
• Track MRC sales during the outage

Once PAX is restored, credit unions must enter the sale into PAX and issue the official MRC certificate to the member.

Yes. TruStage can help answer any additional questions you may have.

Once PAX is back online, PAX will work as a standalone version if connectivity was removed. If you choose to restore connectivity, it will need to be set up again.  TruStage will work with the credit union and systems providers to reinstate credentials and the connectivity.

This is a credit union decision.  

Emails are an unapproved method of sending restricted or sensitive data according to our Information Classification and Data Handling policy. We are required to send files through SFTP (SSH File Transfer Protocol) or another secured file transmission service. OpenText was chosen as a solution for safely handling sensitive claims data.

Yes, Core Content uses encryption. Data is encrypted in transit via HTTPS/TLS 1.3, and it is encrypted at rest using AES256.

When the user stays signed in while not actively using Core Content, the browser eventually times out. When this happens, users need to close their browser, reopen a new window, and navigate to Core Content.

Please use the forgot password option when attempting to sign in and follow the prompts.

Having trouble determining where to request a password reset email? Please access the direct page where you can request a password reset.

You will be locked out, but only temporarily. Wait at least 15 minutes after receiving the “your account has been locked” email and try again. At this point, it is recommended to use the forgot password option.

Consider the following:

1. Are you using the email address you were provided to sign up with?
2. Are all fields filled out?
3. Does your password meet all requirements?
   • You can determine this by finding the checkmarks under the first password entry.
   • The requirements are:
     • 10 Characters
     • 1 Uppercase
     • 1 Lowercase
     • 1 Digit
     • 1 Symbol

If users are not receiving notifications, they should thoroughly check their SPAM and/Junk email folders.

No. We explored options with OpenText to provide email notifications when a new file is dropped, however that capability is not currently available. Our goal is to drop a new member-level payment file in OpenText within three business days after you have received the ACH. Please routinely check OpenText for new files after receiving an ACH for lending claims.

Your OpenText user ID is the email address that TruStage used when setting you up.

There is a possibility that the OpenText email is blocked within your exchange system. While this is not something that TruStage can help with, there is a tool on your Mail Exchange which includes spam filtering, phishing protection, malware detection, and email threat protection. If permitted by your organization’s policies, once in that space within exchange, you can add a rule to allow emails coming from opentext.com.

Credit unions should hold Plastic Card Policy claims until further notice and should not email any Personally Identifiable Information (PII), including credit card numbers, to TruStage. A secure submission process is being established, and TruStage will notify credit unions when it becomes available. To ensure policyholders are not disadvantaged by this temporary pause, the claim submission timeframe will be extended by the number of days submissions are on hold.

Claims are generally worked in the order received, but payment can be issued once all required information is available. Product type, complexity, documentation and coverage validation affect timing, so a newer claim may be paid while an older claim remains open pending additional information. Added system visibility and improvements to imaging and indexing inbound correspondence are helping support claims review, but validation, manual processes and backlogs continue to affect the pace.

Some claims require additional information before they can move into review and adjudication. Collecting complete claim information, validating coverage, and confirming claim details helps ensure claims can be processed accurately and efficiently.

Members who wish to cancel a policy or make changes to their coverage should visit the Life and AD&D Service Forms page and submit the appropriate form. As servicing capabilities continue to be restored, TruStage will process requests and honor them based on the date they were received. TruStage will remove Life and AD&D customers from automatic recurring billing when they request cancellation or policy surrender. Because of the processing backlog, there may be a delay between receipt of the request and when billing is stopped.

TruStage remains committed to helping credit unions protect their members through responsible, thoughtful marketing. Direct mail and email marketing for AD&D, Life and Auto Insurance products is currently paused. Future marketing activities are being evaluated as part of our recovery and resiliency efforts, with member experience, operational readiness, and business continuity guiding decisions. Members may continue to see previously distributed marketing materials within the credit union channel, such as website banners, branch materials, brochures, and other collateral.

• For AD&D, SIT, and SIWL – if a member has received a TruStage direct mail offer, they may complete the application included in the mailing and return it by mail. At this time new AD&D, SIT, and SIWL policies cannot be initiated through the TruStage call center or on TruStage.com. Members must use the direct mail application they received to apply.
• For Auto & Home – yes, members can continue to receive Auto & Home quotes through our partnership with Liberty Mutual and Polly and purchase coverage. They can service their policies, and access claims support without disruption. While the servicing experience remains largely unchanged, the member’s online experience may look different for now. We are continuing to refine that experience as systems and capabilities are restored.

Members will not experience a loss of coverage due to their inability to take action on a policy during the service disruption. TruStage will continue to provide accommodations, including extending deadlines for policy conversions, as processing activities resume.

BenefitsForYou remains stable following its initial participant launch, with digital access expanding to plan sponsors, advisors and third-party administrators. Contribution and withdrawal backlogs continue, although retirement account data has become more current as processing catches up. Broader transaction capabilities will return in subsequent phases.

All Business Protection policy servicing requests should be sent to BusinessProtection@trustage.com.

The RRQ is currently unavailable. Additional time will be provided to complete the RRQ once system functionality is restored. We will notify CUs when the RRQ is available.