|
By Ray Birch
MADISON, Wis.— Six weeks after TruStage discovered the cyberattack that forced much of its technology environment offline, significant portions of its operations are returning—but for some credit union members and other consumers, the disruption is still being measured in missed insurance payments, inaccessible retirement money, delayed disability benefits and difficulty collecting on life insurance policies following the death of a family member.
The continuing problems are evident in both TruStage's service status and complaints from consumers. According to TruStage’s Outage Tracker, which monitors the company's public updates, currently lists nine services as available, 13 as delayed and seven as disrupted. Among the affected areas are GAP and mechanical-repair claims, payment-protection claims, recurring ACH premium payments, annuity withdrawals, life and AD&D servicing, retirement distributions and loans, online account access and transactions, and life-policy withdrawals, loans and surrenders.
TruStage has told credit unions that claims filed with the organization "may still be delayed" and advises them to continue collecting documentation and logging member inquiries for follow-up.
For some consumers, those aren't abstract service disruptions. In a Reddit post Friday, Aug. 21, a consumer alleged his father died shortly after TruStage's systems went down and that he and his mother had spent nearly a month trying to get the life-insurance claim moving. The poster said forms had been submitted online and paperwork sent to TruStage's claims email, but the family had not received a claim number and therefore could not submit the death certificate. The poster said bills were coming due and TruStage representatives could not provide a date when new life insurance claims processing would resume.
Other families have reported similar problems. On Trustpilot, one reviewer alleged Aug. 18 that attempts had been made for four to five weeks to contact TruStage about a claim involving the reviewer's father's funeral, with multiple claims submitted but no response. Another reviewer claimed her husband died July 23 and she had been unable to access his life insurance policy, while two funeral homes were waiting to be paid.
A third alleged a claim involving a father who died July 7 had been accepted before the outage and payment was supposed to arrive within three to five business days, but the money still had not arrived weeks later. TruStage responded publicly to several such reviews with condolences and directions to its outage resources.
Consumers are also reporting consequences from interrupted disability and debt-protection benefits. One Trustpilot reviewer purported disability benefits had stopped and claimed the loss of payments was putting medical services, a vehicle and a home at risk.
Premium processing has created another problem: uncertainty over when money will—or won't—come out of members' accounts. In a Reddit discussion that remained active through Aug. 20, one policyholder suggested TruStage had indicated autopay would not operate during the outage, only to have a payment unexpectedly appear as pending, raising concerns that additional withdrawals could overdraw the account.
CUs In The Middle
These problems have put credit unions in the middle, with members often turning to their CU for answers about TruStage products and services even though the institutions have no control over the affected systems or the pace of the recovery. Credit union CEOs have told CUToday.info they are concerned about damage to their organizations’ reputations.
Meanwhile, TruStage has been reporting .the recovery is not stalling. The company has restored substantial portions of its operations. As CUToday.info recently reported TruStage says it has restored additional member-facing services and resumed processing payments and claims across several lines of business as it continues recovering from the cyberattack.
In an update sent to credit union partners Friday afternoon, Chief Administrative Officer Greg Holman said TruStage is increasingly moving from rebuilding foundational infrastructure to improving customer experiences and expanding available services. The company said contact centers for Retirement, Consumer Insurance, Annuity and Pension Risk Transfer are now operating and have handled more than 42,000 calls since Aug. 13, with billing, payment and policy questions accounting for most inquiries.
TruStage also said monthly ACH consumer billing has resumed across multiple products and payment methods, while policies remain active as it addresses missed payments and other payment issues. Claims processing has restarted for pre-outage GAP claims, recurring debt-protection and credit-insurance benefits for larger-volume credit unions, along with select life claims. The company said it continues working through both claims that were pending when systems went down and newly submitted claims.
Retirement and wealth operations are also being restored. Most defined-contribution plan participants can now request withdrawals, loans and rollovers and obtain pre-outage account balances, while certain annuity death claim processing has resumed. TruStage reiterated that annuity and retirement plan assets were not affected by the attack. An interim digital portal launched Aug. 19 also allows most 401(k) clients to submit payroll contributions electronically, with TruStage saying files will be processed in order by payroll check date as it works through the backlog.
The update follows CUToday.info's Aug. 12 report that cybersecurity firm Mandiant had confirmed TruStage established a “clean, isolated environment” separate from affected or potentially affected systems and found no evidence of an active intrusion or threat actor activity since July 11. At the time, TruStage cautioned that determining whether member or employee information was compromised could still take another two to three months. TruStage said Friday that A.M. Best has also affirmed the company's A (Excellent) Financial Strength Rating.
Meanwhile, the legal fallout from the incident continues. As CUToday.info previously reported, 14 proposed class-action lawsuits had been filed as of its last update, including actions brought on behalf of credit unions and consumers alleging TruStage failed to adequately protect information and systems. The allegations remain unproven, and TruStage has not determined that member or employee data was compromised.
The continuing recovery has also forced TruStage to scrap one of its largest industry events. As CUToday.info reported earlier Friday, TruStage canceled its Discovery 2026 conference, which had been scheduled for Aug. 27, saying its focus needs to remain on recovery efforts and serving customers and partners. The company said key Discovery content instead will be distributed through a thought-leadership series in coming months.
