TruStage Resumes Operations After Cyberattack: Key Developments and Focus Areas

TruStage, based in Madison, Wisconsin, has resumed more services for its members and reinstated payment and claims handling following a cyberattack that disrupted operations for nearly six weeks.

TruStage is shifting its focus from simply restoring essential infrastructure to improving customer experiences and expanding service availability. This pivot was highlighted by Chief Administrative Officer Greg Holman in a message to credit union partners. The company has reported that its contact centers are now fully operational, successfully managing over 42,000 calls since August 13. Most of these calls have centered on billing, payment, and policy inquiries, indicating a keen interest from policyholders on continued service and support.

Progress in Restoring Operations

Monthly ACH consumer billing has restarted, addressing the previous disruptions in payment processes. TruStage confirmed that all policies have remained active during this recovery phase, ensuring minimal coverage impact on consumers. Claims processing is back on track, particularly for pre-cyberattack GAP claims and other specific benefits focused on larger-volume credit unions.

The scope of restoration also encompasses retirement and wealth services. Participants in defined-contribution plans can now access withdrawals, loans, and rollovers, with balances restored to pre-incident levels. A specialized digital portal, launched on August 19, is facilitating most 401(k) transactions, helping to manage the backlog by processing based on payroll check dates.

Security and Legal Responses

A cybersecurity review by Mandiant confirmed that TruStage has successfully established a clean and isolated environment, separate from affected systems. While no active breach is currently detected, a complete assessment to confirm any data compromise may take up to three additional months. Legal actions are underway, with 14 class-action lawsuits filed alleging insufficient data protection. These claims remain unproven at this time, and the company has not acknowledged any breaches of personal information.

Strategic Decisions and Future Directions

In light of the ongoing recovery, TruStage canceled its Discovery 2026 conference slated for August 27. This strategic decision allows the company to concentrate on its recovery processes and customer service. TruStage plans to replace the event with a thought-leadership series, ensuring that stakeholders still receive valuable insights during this recovery period.

"Our commitment is to rebuilding trust through tangible actions." Greg Holman, Chief Administrative Officer, TruStage

Key Recovery Milestones

• Monthly ACH consumer billing resumed for numerous products.
• Pre-cyberattack GAP claims and certain life claims processing restarted.
• Defined-contribution plan withdrawals, loans, and rollovers accessible.
• Secure and isolated system environment established.
• Interim digital portal launched for 401(k) contributions.

TruStage's ongoing commitment to its credit union partners and consumers is clear as it continues to reinforce its operations and build resilience against such incidents in the future. Insurance industry professionals should follow these developments closely, as they may impact regulatory approaches and cybersecurity protocols across the sector.