Skip to Main Content

09/20/2026

The organization continues to restore systems following a recent cybersecurity attack. While significant progress has been made, some services remain unavailable as we work to restore operations safely and securely. Thank you for your patience. Learn more

TruStage is actively investigating a cybersecurity attack

TruStage® continues to make progress in its recovery and restoration efforts following the cybersecurity attack identified on July 11. Given the broad impact across our network and systems, we are rebuilding portions of our infrastructure to ensure services are restored safely and securely. This deliberate approach helps protect employees, partners, members, customers, and the organization as we bring systems and applications back online. We value your partnership and appreciate your patience. Please see below for further information.

Current status

Status: Investigating
Last Updated: September 18, 2026 | 9:01 AM CT

Customers may experience difficulty accessing account information, completing transactions or submitting requests online.

Our commitment

  • We take the security of our systems and the information entrusted to us seriously.
  • Our priority is to restore systems in a safe, secure and responsible manner.
  • As we learn more, we will provide additional updates as appropriate.

What you should know

The TruStage Wealth Management Solutions Financial Advisors can support members through their access with LPL. They can sell and service all products except for TruStage Annuities. Annuity forms can be accessed here.

Frequently asked questions during the outage

  • Advisors and CUs can access Salesforce through a direct login. Please work with your assigned Advisor Manager Specialist or Regional Program Consultant for specific instructions.

  • TruStage Wealth Management Solutions will be communicating updates on a regular basis that we believe are important to support our advisors and credit union programs as such updates become available. Note: other areas of TruStage will also be communicating updates separately from TruStage Wealth Management Solutions that may also be provided to our advisors and credit union programs.

  • We have now enabled an online option for clients to submit partial withdrawal and surrender requests. Contract owners may request cash withdrawals or surrenders by completing the form available here and submitting it to us using the instructions provided. We continue to work diligently to restore full functionality. Details will be posted on this website as we continue to expand available services and update contact information. Please note that processing times may still be delayed due to manual processing requirements and current system limitations.

  • TruStage continues to make progress restoring services through a deliberate, phased recovery approach. Because this incident affected a broad portion of the technology environment, systems and applications are being restored carefully to ensure they are secure, stable and validated before returning to service. Many critical capabilities have already been restored, and additional functionality continues to come online. While progress is being made every day, some capabilities will require additional time as recovery efforts continue. Recovery is increasingly moving from access to execution: more customers and members are reaching TruStage, more claims are moving through the process and more transactions are being completed. Some services continue to rely on interim or manual processes.

  • TruStage continues to conduct a comprehensive forensic and data-impact analysis with the assistance of external cybersecurity experts. Determining whether any information was accessed and understanding the scope of any potential impact requires extensive investigation and validation. Because of the complexity of this process, the analysis is expected to take additional time. If TruStage determines that notifications are required, those communications will be made through the appropriate channels.

  • Mandiant updated its Investigation Memo on Aug. 27 to reflect the latest forensic evidence reviewed. Based on its investigation, Mandiant has found no evidence of threat actor activity in the affected environments since July 11, 2026, when TruStage identified the incident and took action to contain and remediate it.

  • Because notification requirements can depend on your specific relationship with your customers, applicable laws and regulations, and your own policies, we recommend that you consult with your legal, compliance and risk teams.

    At this stage, it would be premature to draw conclusions about the scope or impact of the incident.

  • The NCUA is aware of this event. If your credit union determines it is a reportable event to the NCUA, the NCUA has informed us that it is sufficient to call or email the NCUA, provide your credit union name and inform them that you are reporting regarding the TruStage cybersecurity event. You can call the NCUA at 1-833-CYBERCU (1-833-292-3728) and leave a voicemail or email at cybercu@ncua.gov to accomplish that report.

  • TruStage Wealth Management Solutions paid managed advisors and dual credit unions as regularly scheduled for all of July and August. Estimates that were paid for the month of July were recouped with the actuals in August.

If you still have questions, please connect with your account representative.