TruStage After 100 Days: Plenty About Recovery, No Update on the Data

Jeff Bassill  |  CU Risk Advisors

October 2026  ·  Vendor Risk  ·  TruStage Series, Part 3

TruStage has spent three months telling credit unions which services are coming back. Claims intake, call center wait times, retirement account access and billing have all been covered. In my view, the question that carries the most risk for credit unions hasn't been addressed since August: was member data accessed or taken before TruStage locked down its network?

TruStage identified the attack on July 11. That was more than three months ago.

The timeline TruStage set for itself

On August 12, CEO Terrance Williams told credit union partners that TruStage was working with Mandiant and data analysis firm Epiq Global. He said the process was complicated enough that it would likely take another 2 to 3 months to determine whether member data was compromised. That estimate points to a period between October 12 and November 12, although TruStage did not describe it as a firm deadline. Nothing I have seen since August addresses where that investigation stands. The public outage page was updated October 13, and it covers claims, servicing and disbursements without an update on the data review.

Epiq's involvement should not be read as evidence that data was compromised. Firms like Epiq are often brought in after a cyber incident to review files and determine whether personal information may have been involved. TruStage has not said that any member data was accessed or taken. The review means the question is still open, so credit unions should remain prepared for an answer rather than assume the issue was resolved when systems came back online.

Containment answers a different question

Mandiant's August 10 memo confirmed that TruStage had built a clean, isolated environment. That's real progress, but it answers only what is happening now. Imagine coming home to find water on the kitchen floor. A plumber shuts off the main valve and confirms no more water is coming in. The leak is stopped, but you still don't know how long it ran or what got wet. TruStage's containment work is much the same. It guards against further access, but it does not tell credit unions whether data was accessed or taken before the network was locked down. Most credit unions also still do not know whether their members' data was on the affected systems.

Restoration was never the biggest risk

An outage is costly, and members have paid for this one in delayed claims and locked retirement accounts. But an outage ends. A data compromise keeps going after the systems return, and much of the work lands on credit unions.

If TruStage notifies a credit union that its members' information was involved, the credit union must promptly determine whether the notice gives it a reasonable basis to believe it experienced a reportable cyber incident. A federally insured credit union must notify NCUA as soon as possible and no later than 72 hours after reaching that belief or after receiving third-party notice of a reportable incident. The credit union must also evaluate its member-notification responsibilities under Appendix B and applicable state law. The lawsuits illustrate the potential exposure, but the allegations have not been adjudicated. The Peixoto suit names Align Credit Union as a defendant, while the Nivens and Landers suits name First Financial Federal Credit Union. Members may not separate TruStage from the credit union that sold them the product.

Put the follow-up in writing

At 100 days, it's reasonable to stop waiting for the next update and put specific questions in writing. A dated request shows your board and examiner that you asked, and it gives TruStage something concrete to answer. I would ask:

•      Has the forensic review determined whether data was accessed or removed? If not, what is the revised date?

•      Were systems holding our members' or employees' information inside the affected environment?

•      Has anyone claimed to hold TruStage data or made a demand?

•      Will TruStage share Mandiant's findings beyond the August 10 containment memo?

•      If our members are affected, who sends the notices, who pays for them, and what will we receive and when?

This takes your risk officer an hour. Keep the sent copy in your incident file. If you have no answer by November 12, when TruStage's own window closes, record the non-response as a finding in your vendor review and report it to your board at its next meeting.

While you're at it, confirm your fidelity bond claims process works today. Ask how to file a loss right now, by what channel, and how long acknowledgment takes. A bond is only as useful as your ability to file against it.

What this may mean at renewal

My view is that TruStage keeps most of its credit union bonding business. Few carriers compete for it, and switching a bond is a heavy lift for a small credit union.

The consumer side will face more scrutiny. GAP, mechanical repair, debt protection, credit life, annuities and retirement plans all come up for a decision eventually, and service disruptions will be one factor credit unions and members remember when they do. Plan sponsors have their own responsibilities. A sponsor whose employees have gone months without normal access to their 401(k) accounts has a fiduciary duty to monitor that provider, and this disruption belongs in that review. Competitors are also likely to raise this incident in future sales discussions.

TruStage's longstanding relationship with the credit union movement remains an important strength. Its history as CUNA Mutual has created loyalty and familiarity that likely contributed to patience during the disruption. Future renewal decisions will depend on both that relationship and how clearly TruStage addresses the remaining questions about data. A clear answer delivered first to the affected credit unions, even if the answer is difficult, would help rebuild confidence as recovery continues.

For your own planning, put TruStage's service record since July in your next vendor review. Note which products were unavailable, for how long, and how claims were handled. When a TruStage product comes up for renewal, weigh that record and the outcome of the data investigation alongside price.

The views in this post are my own and do not represent the official position of Kings Federal Credit Union. Nothing here asserts that member data was accessed or taken in the TruStage incident. Comments on renewal decisions are my opinion about issues credit unions should weigh.

Sources: TruStage recovery status page (trustage.com/outage, Oct. 13, 2026); Credit Union Daily, "TruStage Offers New Update on Cybersecurity Incident" (Aug. 13, 2026); American Banker, "CU vendor TruStage faces 14 suits over monthslong outage" (Aug. 2026); Epiq, "Cyber Incident Response Services" (accessed Oct. 18, 2026).