Credit union recovery updates and available support

Please review the technical FAQs of the cybersecurity incident here.

TruStage continues to make progress restoring services through a deliberate, phased recovery approach. Because this incident affected a broad portion of the technology environment, systems and applications are being restored carefully to ensure they are secure, stable and validated before returning to service. Many critical capabilities have already been restored, and additional functionality continues to come online. While progress is being made every day, some capabilities will require additional time as recovery efforts continue. Recovery is increasingly moving from access to execution: more customers and members are reaching TruStage, more claims are moving through the process and more transactions are being completed. Some services continue to rely on interim or manual processes.

Mandiant updated its Investigation Memo on Aug. 27 to reflect the latest forensic evidence reviewed. Based on its investigation, Mandiant has found no evidence of threat actor activity in the affected environments since July 11, 2026, when TruStage identified the incident and took action to contain and remediate it.

No. We are not encouraging, facilitating, or participating in efforts to replace, surrender, or discontinue in-force insurance coverage as a result of this incident or as part of our ongoing business recovery efforts.

TruStage continues to conduct a comprehensive forensic and data-impact analysis with the assistance of external cybersecurity experts. Determining whether any information was accessed and understanding the scope of any potential impact requires extensive investigation and validation. Because of the complexity of this process, the analysis is expected to take additional time. If TruStage determines that notifications are required, those communications will be made through the appropriate channels.

We understand that situations like this can raise questions and concerns. As our understanding of the situation evolves, we will communicate appropriately.

Customers can visit trustage.com/outage/individual for the latest updates, resources and FAQs related to the service disruption. TruStage will continue to update available information as restoration efforts progress.

The NCUA is aware of this event. If your credit union determines it is a reportable event to the NCUA, the NCUA has informed us that it is sufficient to call or email the NCUA, provide your credit union name and inform them that you are reporting regarding the TruStage cybersecurity event. You can call the NCUA at 1-833-CYBERCU (1-833-292-3728) and leave a voicemail or email at cybercu@ncua.gov to accomplish that report.

The investigation remains ongoing, supported by Mandiant and Epiq Global. If we determine that member, employee, or other affected data has been impacted, credit unions will hear that information directly from us first — with the intent to provide the time to sufficiently partner with you on any communication we may need to do. We also remain committed to supporting you through any notification or reporting requirements and making that process as straightforward as possible.

At this time, customers who need to make changes to their policy (address change, beneficiary change, etc.), or who wish to cancel their policy, should follow the instructions on the applicable form found on the TruStage outage page for individuals: trustage.com/outage/individual/service-forms. For many customer service transactions, the form must be submitted by mail. This helps ensure forms and supporting documentation are received through a controlled process with the necessary customer authorization. For policyholders needing to file a claim, they can submit first notice of loss online at trustage.com/startclaim which routes to our Claims team for processing.

Submitting forms by mail helps ensure information and supporting documentation are received through a controlled process with the necessary customer authorization. This process also helps support appropriate security, privacy, and record-retention requirements while recovery efforts continue.

We have reviewed alternative channels, including email, fax, and online upload; however, due to sensitive payment information or other restricted consumer information, the appropriate security, privacy, authentication, and retention controls must first be in place and approved. Until then, customers should follow the submission instructions on their form or the service communication they received.

For certain products, limited phone-based transaction support may be available. Customers should contact the appropriate service team to understand what capabilities are currently available for their product.

Yes. Teams are continually evaluating whether additional channels can be made available for consumers in a way that meets security, operational, compliance, and customer experience expectations. Restricted information and sensitive payment data remain key considerations before any upload, email, fax, or other digital submission option can be approved for use.

Claims payment activities have resumed across several areas of the business. Claims remain a priority, and TruStage continues working through backlogs while expanding capabilities and reducing service disruptions. We have started to pay claims across our business, including preplanning/funeral claims, GAP claims and debt protection/credit insurance benefits. Here’s what customers should know:

1. Customers can report a new claim online, provide claim-related information or receive guidance on next steps. If a claim has already been submitted, they should not file a duplicate claim.
2. Customer support is available. TruStage representatives are available to receive customer inquiries and provide available guidance.
3. Some claims activities remain limited. Some servicing and claims-related activities remain limited while systems are being restored.
4. Claims will be processed as capabilities are restored. Claims will be processed and paid in accordance with applicable policy terms and conditions as operational capabilities are restored. At this time, product-specific claim payment timelines are not available.
5. For Life and AD&D claims, we are restoring core processing capabilities, and will focus first on claims that were pending at the time of the outage before moving to claims received afterward. We will work through this backlog as quickly as possible, but that will take time.
6. A temporary GAP claim payment process began on Aug. 12 to resume GAP claim payments for open and pending claims established prior to the cybersecurity attack. Two payment options will be available.
7. Some GAP claims are not included at this time. This temporary process applies only to open and pending claims that were established prior to the cybersecurity attack. Claims submitted after the cybersecurity attack through the claim intake form are not included at this time.

We will continue to provide updates as additional information becomes available.

Claims remain a top priority. We have started to pay claims across our business, including preplanning/funeral claims, GAP claims, and debt protection/credit insurance benefits.

• For Life and AD&D claims, we are restoring core processing capabilities and will focus first on claims that were pending at the time of the outage before moving to claims received afterward. We will work through the backlog as quickly as possible, but that will take time.
• Currently, members can submit their first notice of loss at trustage.com/startclaim and receive email confirmation.
• A claims representative is reaching out to the person who submitted the claim to confirm receipt and gather any information needed.

While claims processing capabilities continue to expand, even under normal operations some individual claims may be more complex and require different levels of review, documentation, validation, or investigation. Because of these differences, TruStage cannot provide claim-specific payment timelines.

TruStage has started restoring some payment processing capabilities, but some billing and payment options remain limited. Members may use available payment options or mail payments using instructions on the TruStage outage hub. One-time payments by phone and certain paper-billing functions remain unavailable. Coverage protections and grace-period accommodations remain in place.

Here’s what customers should know:

1. On August 4, TruStage began resuming recurring ACH payments for certain Life and Accidental Death and Dismemberment (AD&D) policies. We are currently processing recurring ACH payments for policies with payments due dates in late July through August.
2. On August 20, TruStage initiated recurring credit card drafts. As with the resumption of ACH withdrawals, customers were not billed twice for a missed payment.
3. Paper billing and one-time payments are not yet available and are actively being worked on.
4. Representatives may not be able to verify individual payment status. Because account access remains limited, representatives cannot verify individual payment activity.
5. TruStage is not currently sending past-due payment requests. TruStage is not currently sending communications requesting premium payments or advising customers that they are delinquent on a policy payment.
6. Be cautious with payment related messages. If customers receive a communication indicating they are past due or requesting payment, they should not click any links, provide personal information or submit payment information. Customers should rely on official TruStage communications and resources for the latest information.

If a member requested changes to or cancellation of their policy during the outage, those requests may not yet be reflected in current billing activity. As systems and servicing capabilities continue to be restored, TruStage will process requests and honor them based on the date they were received.

If a policy was active or within an applicable grace period when the service disruption occurred, it will remain in that status while TruStage works to restore normal payment processing. Claims will continue to be evaluated and handled according to the terms and conditions of the policy. To support customers affected by the service disruption, TruStage is extending applicable grace periods. Additional information will be provided as normal servicing operations resume.

Depending on the timing of a customer's regularly scheduled premium payments, more than one premium payment may become due during the extended grace period. TruStage is evaluating customer payment scenarios as systems are restored and will communicate directly with affected customers regarding any actions required. Additional information will be provided as it becomes available.

BenefitsForYou remains unavailable while systems are being safely restored. At this time, account balance and plan benefit information cannot be accessed through the platform. There has been no impact to annuity or retirement account balances or benefits as a result of the cybersecurity incident. We continue to restore systems in a controlled and secure manner and will provide updates as additional functionality becomes available.

Recurring monthly ACH and certain recurring credit card billing have resumed for certain Life, AD&D and Preplanning customers as part of TruStage’s phased recovery efforts. Additional capabilities will continue to come online as systems and processes are tested and validated.

One of the most common concerns we've heard from customers throughout this disruption has been their ability to make premium payments and maintain coverage. Restoring billing capabilities helps address that concern and provides reassurance that coverage remains in force while recovery efforts continue.

No. Billing restoration is one step in a broader recovery effort. We continue to restore systems and capabilities as they are tested, validated and ready.

As systems and processes continue to come back online, some customers may experience delays, processing exceptions or other service-related issues. Teams are monitoring performance closely and working to identify and address issues as quickly as possible.

Recurring monthly ACH and credit card billing is resuming. As a result, some customers may see their regularly scheduled premium payment drafted even if a prior premium payment was not processed during the service disruption.

Representatives do not currently have access to individual account information and cannot determine the status of specific premium payments at this time.

Additional information will be provided as systems and services continue to be restored.

Customers that have questions about ACH or credit card billing activity should be encouraged to visit the Individual Service Hub (trustage.com/outage/individual). TruStage continues to expand customer service capabilities and will provide additional information as recovery efforts progress.

Dedicated response teams are actively working to restore systems and support critical business processes.

• Credit unions should continue gathering claim details and supporting documentation and submit new claims through the approved claim-start process at trustage.com/startclaim.
• TruStage teams are actively engaging with members and credit unions to obtain needed information and advance claims through the process.
• Updates will be shared as information becomes available.
• Our priority remains minimizing disruption for credit unions and their members while restoring services safely and responsibly.

If your data processor typically submits your monthly files to TruStage, no action is required at this time. TruStage is working directly with data processors and has asked them to hold monthly files until systems are available to receive and process them.

Credit unions that submit monthly files directly to TruStage should retain those files and hold them until TruStage confirms that file receipt and processing capabilities have been restored. Additional instructions will be provided when submissions can resume.

Yes. A First Notice of Loss (FNOL) process is available and TruStage is actively restoring claims payment capabilities. Please work with your account team for the latest protection product updates.

No, credit unions support member level cancellation of CI/DP.  Refunds are not normally required with cancellations as premium/fees are charged in arrears.  After a cancellation occurs, premium/fees are not charged going forward. 

If a refund is required for any reason, credit unions can provide the member refund and submit to TruStage when systems become available. 

TruStage has implemented a temporary business continuity process to help minimize disruption for members receiving previously approved recurring Debt Protection benefits. Payments are being prioritized for credit unions with the highest volume of approved recurring benefits and will continue to expand as recovery efforts progress. Credit unions with questions about specific member situations should contact the Claims team for assistance.

Continue to obtain your monthly premium reports from your data processing system as you normally would. However, those reports should be retained and held until TruStage advises that reporting and processing systems are available. At that time, additional instructions will be provided if needed.

No. Credit union products will not be canceled for non-payment during the current service disruption. Credit unions should retain their reporting information and await further guidance from TruStage regarding submission and processing.

TruStage is developing processes for both GAP and MRC to capture workaround data and issue member contracts. Additional details about the processes and timing will be shared as they become available.

Several temporary business continuity processes have been established to help credit unions continue serving members while systems are unavailable:

For GAP:

• Eligible PAX credit unions may use the approved GAP workaround
• Credit unions should maintain documentation of all sales during the outage
• Sales must be entered into PAX once service is restored

For MRC:

• Selected credit unions may use Assurant's GLOW platform to generate quotes
• GLOW does not issue contracts
• Credit unions must track all MRC sales completed during the outage and process them in PAX after restoration

For GAP claims and servicing:

• Credit unions should continue collecting claim details and supporting documentation
• TruStage teams are actively working to restore systems and provide ongoing guidance
• Updates will be shared as reliable information becomes available

Yes. GAP waivers and MRC certificates issued in accordance with TruStage’s approved outage procedures will be honored. TruStage is developing processes for both GAP and MRC to capture workaround data and issue member contracts. Additional details about the processes and timing will be shared as they become available.

If a member exceeds the number of skipped payments permitted under their GAP contract due to delays in Credit Insurance/Debt Protection (CI/DP) claims processing caused by the system outage, TruStage will account for those additional skipped payments when calculating the Protected Balance on a future GAP claim for a total loss.

Members may exceed the maximum number of skipped payments stated in their GAP contract by up to the number of months the outage continues. For example, if the outage lasts three months, TruStage will allow up to three additional skipped payments beyond the contract limit to be included in the Protected Balance calculation.

Until systems are back up and running, credit unions should proceed, accept, and release their letters of guarantee on total loss settlements during this outage so there isn’t a delay of any part of the total loss process for credit unions or their members.   

Once our systems are back online and the GAP claim is adjudicated, credit unions (and members) will not be penalized by TruStage for releasing the letter of guarantee during the system outage as described above. 

We will extend the qualifying time for the Plus benefit to correspond with the length of our outage. For example, if our inability to administer/pay Plus claims is 60 days, we'll extend the timeframe to file a Plus claim to 180 days. 

For claims and servicing credit unions should continue collecting claim details and supporting documentation. TruStage teams are actively working to restore systems and provide ongoing guidance. Updates will be shared as information becomes available.

Yes, there is no change to our MRC claims process. Members should work with a repair facility, which can submit claims directly to Assurant for review and payment. Assurant can pay the repair facility directly.

Yes, a limited MRC quoting workaround is available through Assurant's GLOW platform for a select group of high-volume credit unions.

Key points:

• GLOW can be used to generate MRC quotes and member pricing
• GLOW is for quoting only and does not issue MRC contracts
• Participation is limited due to implementation and support capacity
• Selected credit unions will receive separate communications and implementation instructions

Credit unions using GLOW can:

• Generate MRC quotes based on vehicle information
• Present pricing to members
• Finance the MRC cost as part of the loan
• Track MRC sales during the outage

Once PAX is restored, credit unions must enter the sale into PAX and issue the official MRC certificate to the member.

Yes. TruStage can help answer any additional questions you may have.

Once PAX is back online, PAX will work as a standalone version if connectivity was removed. If you choose to restore connectivity, it will need to be set up again.  TruStage will work with the credit union and systems providers to reinstate credentials and the connectivity.

This is a credit union decision.  

Different products, claim types, documentation requirements, and processing capabilities may affect how claims move through review and payment activities. TruStage continues expanding claims capabilities and processing capacity while working to move claims through the process as quickly and responsibly as possible.

Some claims require additional information before they can move into review and adjudication. Collecting complete claim information, validating coverage, and confirming claim details helps ensure claims can be processed accurately and efficiently.

Members who wish to cancel a policy or make changes to their coverage should visit the Life and AD&D Service Forms page and submit the appropriate form. As servicing capabilities continue to be restored, TruStage will process requests and honor them based on the date they were received.

TruStage remains committed to helping credit unions protect their members through responsible, thoughtful marketing. Currently direct mail and email marketing for AD&D, Life and Auto Insurance products is paused through November. Future marketing activities are being evaluated as part of our recovery and resiliency efforts, with member experience, operational readiness, and business continuity guiding decisions. Members may continue to see previously distributed marketing materials within the credit union channel, such as website banners, branch materials, brochures, and other collateral.

• For AD&D, SIT, and SIWL – if a member has received a TruStage direct mail offer, they may complete the application included in the mailing and return it by mail. At this time new AD&D, SIT, and SIWL policies cannot be initiated through the TruStage call center or on TruStage.com. Members must use the direct mail application they received to apply.
• For Auto & Home – yes, members can continue to receive Auto & Home quotes through our partnership with Liberty Mutual and Polly and purchase coverage. They can service their policies, and access claims support without disruption. While the servicing experience remains largely unchanged, the member’s online experience may look different for now. We are continuing to refine that experience as systems and capabilities are restored.

Members will not experience a loss of coverage due to their inability to take action on a policy during the service disruption. TruStage will continue to provide accommodations, including extending deadlines for policy conversions, as processing activities resume.

BenefitsForYou remains unavailable while systems are being safely restored. At this time, account balance and plan benefit information cannot be accessed through the platform. There has been no impact to annuity or retirement account balances or benefits as a result of the cybersecurity incident. We continue to restore systems in a controlled and secure manner and will provide updates as additional functionality becomes available.

All Business Protection policy servicing requests should be sent to BusinessProtection@trustage.com.

The RRQ is currently unavailable. Additional time will be provided to complete the RRQ once system functionality is restored. We will notify CUs when the RRQ is available.