TruStage Security Updates

Between our 10:05 p.m. Eastern check on October 7 and our 8:12 a.m. Eastern check on October 8, TruStage expanded the payroll answer for defined contribution plans recordkept on Matrix (401(k), 403(b), governmental and tax-exempt 457(b) and deferred compensation plans not on the Choice Group Variable Annuity) on its BenefitsForYou information site. It says payrolls are generally processed in payroll check date order, with an exception when a file needs more review, for example missing information or unclear instructions. In that case a later file received in good order keeps processing while the earlier one waits.

On forfeitures, a file submitted in good order goes straight through using the plan's current configuration, so a plan that used forfeitures in the past will have them applied again. TruStage says it can follow special instructions not to apply forfeitures only when a file does not go straight through, that it cannot stop a file once processing has started, and that sponsors should contact it to change the plan's configuration for future submissions. The existing answer is otherwise unchanged and reordered: aggregator files through PayKonnect and Payroll Integrations process as usual, and employers who upload directly or through MoveIt use the interim secure-portal process described in TruStage's August 19 and September 18 emails.

For a credit union that sponsors a TruStage retirement plan: if the plan should not apply forfeitures to an upcoming payroll, contact TruStage to change the configuration before submitting the file, not after.

Between our 10:05 p.m. Eastern check on October 7 and our 8:12 a.m. Eastern check on October 8, TruStage rewrote the participant balance answer for defined contribution plans on its BenefitsForYou information site at info.benefitsforyou.com. It now tells existing users to log into BenefitsForYou.com to view available account information, says they will be prompted to reset their password, and says participants who never created a BenefitsForYou account will get access in a later phase. What appears online will vary by plan and restoration phase, and recent contributions, earnings adjustments or other activity may not yet show; values may be displayed as of a specific market-value date. Participants who cannot get in online can still call 800-999-8786, weekdays 8 a.m. to 5 p.m. CT, for limited account information. On October 9 the site added that password reset emails may take several minutes to arrive, and asked participants to allow extra time before requesting another reset.

This is the first TruStage page to name the sign-in address. On October 6 its servicing and disbursements dashboards said online access was returning in phases for existing accounts but gave no address, and that evening benefitsforyou.com began showing a log-in with both Log in and Register buttons. The new answer settles the Register question: an account that did not exist before the outage cannot be created yet. The same site still says TruStage is working to restore full BenefitsForYou.com access.

The rewrite removed the answer's earlier lines saying participants' assets are secure and remain invested and that paper statements are being mailed; the statement line still appears in the site's reporting answer, and the pension answer still says plan assets are secure and remain invested. TruStage has not announced the change on any page this tracker follows.

Between our 8:53 a.m. and 10:04 a.m. Eastern checks on October 8, TruStage replaced the answer to “Have you figured out if any data was compromised?” on its wealth management solutions outage page with the wording its business and annuity pages took on October 7. The earlier answer described a forensic and data-impact analysis with outside experts, said it would take additional time, and said any required notifications would go out through appropriate channels. The new answer says TruStage is still working with outside experts to understand the attack's full impact, including whether any information was accessed, and will notify each affected person directly if customer information is found to have been accessed.

This reports no new finding; it is the October 7 rewrite reaching a third page. Nothing else on the page changed, and its shared “Last Updated” stamp did not move from October 7 at 3:52 p.m. CT.

At our 10:04 a.m. check on October 8, the earlier answer still stood on the credit-union, individual, preneed and retirement outage pages, on the consumer FAQ, and on TruStage Life of Canada's FAQ. TruStage's previous rewrite of this answer took from August 26 to August 31 to reach every tracked US surface.

Between our noon and 2:04 p.m. Eastern checks on October 8, TruStage replaced the answer to “When will you know more about whether data was compromised?” on its credit union outage page with the wording its business and annuity pages took on October 7 and its wealth management page took that morning. The earlier answer described a forensic and data-impact analysis expected to take additional time. The new one says TruStage is still working with outside experts to understand the attack's full impact, including whether any information was accessed, and will notify each affected person directly if customer information is found to have been accessed. A second answer, on how TruStage will keep people informed, now says updates will be posted on the outage page.

The same edit added three lines. The policy-changes answer now says the process to complete life policy surrender requests is active, that TruStage has begun working through the backlog, and that requests may take longer than normal. The cancellation answer now says TruStage can take life and AD&D customers off automatic recurring billing when they ask to cancel or surrender, though the backlog may delay when billing stops. Its servicing dashboard has carried the billing point since September 25, and both dashboards the surrender backlog since October 6. A third line says the credit union and individual outage pages now have FAQ search and that the Retirement Solutions resource site has been expanded, with navigation by role, plan and category.

This reports no new finding on data. The credit union page is the one TruStage points credit unions to, and it is the fourth page carrying the October 7 answer; at our 2:04 p.m. check on October 8, the individual, preneed and retirement outage pages, the consumer FAQ and TruStage Life of Canada's FAQ still carried the earlier one. Separately, the consumer FAQ cut its answer on when participants can reach their 401(k) to one sentence saying online access stays limited while balance visibility and broader digital access are restored. It dropped the note that some participants could request withdrawals and loans and get balance updates by phone; the individual outage page still carries the longer answer, and the consumer FAQ still says balances and plan benefits were not affected.

The credit union page carries no date stamp. TruStage's five dated outage pages re-stamped to October 8 at 12:32 p.m. CT in the same window with no other change, and the consumer FAQ took its daily 11:15 a.m. CT re-stamp.

Between our noon and 2:04 p.m. Eastern checks on October 8, TruStage rewrote two claims answers on its credit union outage page. The answer on the current status of claims processing and payments no longer opens by listing the claim types being paid. It now says processing and payment activity continue to expand, credits “regained visibility into certain systems” with opening access to the policy and document records needed for servicing and claims, and says testing and validation continue. Claims that need more documentation, coverage validation or supporting information may take longer. It adds that service teams are working on contact-center audio quality, call routing by intent, staffing and processes to address wait times and dropped calls.

The answer on why some claims move faster than others now explains the order. Claims are generally worked in the order received, but a payment can go out as soon as all required information is in, so a newer claim may be paid while an older one stays open awaiting information. Product type, complexity, documentation and coverage validation affect timing. TruStage says the added system visibility and better imaging and indexing of incoming correspondence are helping, while validation, manual processes and backlogs still set the pace.

For credit unions, this answers the member who asks why someone else's claim was paid first: missing information, not place in line, is the usual reason. TruStage gives no date or figure, no availability label moved, and the claims dashboard did not change. The same page still lists the claim types TruStage has started paying (preplanning and funeral, GAP, debt protection and credit insurance) in another answer, and still says pre-outage life and AD&D claims are worked before those received afterward; its individual outage page kept the older, general answer on claim speed at that check and took the new one by our 4:38 p.m. check the same day.

The credit union page carries no date stamp. TruStage's five dated outage pages re-stamped to October 8 at 12:32 p.m. CT in the same window with no other change.

Between our 2:04 p.m. and 4:38 p.m. Eastern checks on October 8, TruStage replaced the answer on when it will know more about whether data was compromised on its individual and preneed outage pages. It is the wording the business and annuity pages took on October 7 and the wealth management and credit union pages took earlier on October 8. The earlier answer described a forensic and data-impact analysis expected to take additional time; the new one says TruStage is still working with outside experts to learn the attack's full impact, including whether any information was accessed, and will notify each affected person directly if customer information is found to have been accessed. On both pages the answer on how TruStage will keep people informed now says updates will be posted on the outage page.

This reports no new finding on data. At our 4:38 p.m. check on October 8, six of the seven outage sub-pages carried the new answer; the retirement outage page, the consumer FAQ and TruStage Life of Canada's FAQ still carried the earlier one.

The individual page carries no date stamp, and the preneed page's October 8, 12:32 p.m. CT stamp did not move with the edit. The individual page's payment, call-hours and claim-order changes from the same edit are recorded separately.

Between our 2:04 p.m. and 4:38 p.m. Eastern checks on October 8, TruStage edited several answers on its individual outage page. Two payment answers that said recurring ACH and credit card payments were beginning to resume for some eligible customers now say they have resumed for most customers. Paper billing and one-time payments are still unavailable, and representatives still cannot verify an individual customer's payment activity. The call-hours line for 1-800-779-5433 now reads Monday through Friday, 8:00 a.m. to 5:00 p.m. CT; the Saturday 9:00 a.m. to 1:00 p.m. CT window TruStage restored on September 10 is gone.

The same edit brought two lines the credit union page and servicing dashboard already carried. The cancellation answer now says TruStage can take Life and AD&D customers off automatic recurring billing when they ask to cancel or surrender. The answer on why some claims move faster now says claims are generally worked in the order received but paid once all required information is in, so a newer claim may be paid while an older one waits, and adds that the process remains manual, which delays payment.

For credit unions: correct any posted hours for this line, which no longer lists a Saturday window. Resumed for most customers is not all customers: at our 4:38 p.m. check on October 8, a billing answer higher on the same page still described the restart as covering certain Life, AD&D and Preplanning customers, and the preneed outage page and TruStage Life of Canada's FAQ kept the beginning-to-resume wording. TruStage gave no reason for ending the Saturday hours.

The individual page carries no date stamp, and the five dated outage pages kept their October 8, 12:32 p.m. CT stamp. The same edit's change to the data answer is recorded separately.

In the same October 7 edit, stamped 3:52 p.m. CT and caught between our 4:04 p.m. and 6:04 p.m. Eastern checks, TruStage rewrote the answer on its annuity outage page about whether systematic withdrawals have been processed. The new answer says most existing systematic withdrawals are being processed on their scheduled payment dates, and defines the term to include lifetime income payments, required minimum distributions and other recurring automatic withdrawals. It names one exception, systematic sweeps, and asks contract owners to request a one-time withdrawal on the partial withdrawal form in place of a sweep.

The answer it replaced, in place since mid-August (see the August 18 item), said all outstanding monthly systematic withdrawals had been processed, and that quarterly, semiannual and annual withdrawals were running on schedule only for certain ZoneChoice contracts and most single-premium immediate and annuitized contracts; TruStage said it had not yet identified most others through its interim processing. The new wording drops those product lists and that caveat and names no product still waiting, other than sweeps. The page does not define a systematic sweep.

The partial withdrawal form, in single-owner and joint-owner versions to print and mail, was already on the page. The separate answer telling owners who missed an expected systematic withdrawal to contact their financial professional or TruStage's contact center did not change.

Between our 4:04 p.m. and 6:04 p.m. Eastern checks on October 7, TruStage rewrote two answers in the outage FAQ on its business page and its annuity page, and moved the shared “Last Updated” stamp on its five dated outage pages to October 7 at 3:52 p.m. CT. On the question of when it will know more about whether data was compromised, the answer in place since late August described a comprehensive forensic and data-impact analysis with outside experts, said that analysis would take additional time, and said any required notifications would go out through appropriate channels. The new answer says TruStage is still working with outside experts to understand the attack's full impact, including whether any information was accessed, and that if customer information is found to have been accessed, it will notify each affected person directly with next steps.

The rewrite reports no finding either way. What moves is the commitment: the earlier wording left the notification route open, while the new wording says affected individuals will hear from TruStage directly. It also drops the statement that the analysis will take additional time, without offering a date in its place. A second answer, on how TruStage will keep people informed, now says updates will be posted on the outage page, replacing a general promise to communicate appropriately. Separately, TruStage's credit-union page has said since September 9 that affected credit unions would be notified first, before any communication with their members; that answer did not change.

At our 6:04 p.m. check, the earlier answer still stood on the credit-union, individual, preneed, retirement and wealth management outage pages, on the consumer FAQ, and on TruStage Life of Canada's FAQ. TruStage's previous rewrite of this answer began on the same two pages on August 26 and reached every tracked US surface by August 31, so more pages may follow. The preneed, retirement and wealth management pages took only the new stamp in this edit.

Between our 12:04 p.m. and 2:05 p.m. Eastern checks on October 6, TruStage added two answers to the OpenText section of its credit union outage page. OpenText is the secure file service where TruStage posts member-level payment files for lending claims (see the September 24 item). The first new answer explains the choice: TruStage says its information-classification and data-handling policy does not approve email for restricted or sensitive data, so files must move by SFTP or another secure transfer service, and it chose OpenText to handle sensitive claims data.

The second answer is for credit union staff who still have no OpenText registration email after trying TruStage's other suggestions, which include checking spam and junk folders. TruStage says the message may be blocked inside the credit union's own Exchange mail system, which TruStage cannot fix; if the credit union's policies permit, staff with access to that system can add a rule allowing mail from opentext.com.

The same edit trimmed the page's opening paragraph. It now calls the July 11 event a cyber attack instead of a cybersecurity attack, splits the paragraph in two, and drops the sentence pointing members to trustage.com/startclaim from that spot. The claim-start address still appears three times further down the page, and TruStage's other outage pages keep the cybersecurity-attack wording. The page carries no “last updated” stamp, so the edit is dated by comparing our captures.

Between our 2:05 p.m. and 4:04 p.m. Eastern checks on October 6, TruStage rewrote three sections of its claims status dashboard. The accidental death and dismemberment note now says faxed medical-record information remains unavailable, which continues to affect AD&D claims that require medical records, and that processing times may be longer than normal. The annuity note adds that claims intake remains available and that TruStage's ability to process and pay claims keeps expanding as capabilities return; the annuity payout row still reads unavailable.

The payment protection note was cut to two sentences: claims for credit insurance, debt protection and GAP can be submitted, and they continue to be accepted, reviewed, processed and paid. Three statements came off: that all pre-outage GAP claims had been processed except those awaiting required information, that TruStage had begun contacting members or credit unions to gather information on post-outage claims, and that teams continue expanding review and payment capacity for claims submitted after July 11. The dashboard was the last surface we track carrying the GAP sentence, after the outage hub and credit union page dropped it on September 25, so no claims-completion statement of any kind now appears on TruStage's outage surfaces. TruStage did not say the GAP statement no longer stands.

No availability label moved. The only claims figures TruStage still publishes are on its consumer FAQ, unchanged since September 15. A credit union with a member's AD&D claim that depends on medical records should expect delay; TruStage's service forms page separately says fax is not available.

Between our 2:05 p.m. and 4:04 p.m. Eastern checks on October 6, TruStage replaced the retirement notes on its policy and contract servicing and disbursements dashboards with the same new paragraph. It says BenefitsForYou online account access is returning through a phased approach, and that participants who previously set up an online account may be able to reach certain retirement account information. Participants must reset their password first. Balances shown reflect market value as of the date displayed and may not yet include recent payroll contributions, related earnings adjustments or other transactions still being processed; TruStage says it is still working through previously submitted transactions and will keep updating account information.

This is the first time since the outage began that TruStage has said participant online access is coming back, but the wording is hedged: phased, limited to existing accounts, and participants “may be able to access certain” information. Neither dashboard gives a sign-in address. At the same check benefitsforyou.com still opened TruStage's retirement continuity site at info.benefitsforyou.com, which still says TruStage is working to restore full BenefitsForYou.com access and sends participants to 800-999-8786 for balances. No availability label moved; the retirement rows remain partially available.

The same edit removed the servicing dashboard's list of what retirement representatives can help with (balance information, loan and distribution support, investment changes, and employer contributions through interim processes) and the disbursements dashboard's statement that periodic benefit payments continue. The continuity site still describes the distribution, loan, contribution, investment and installment-payment processes. The outage hub and credit union page mention the change only as expanding retirement participant access to account information.

For a credit union: a participant who already had a BenefitsForYou login may now be able to use it after a password reset, though TruStage does not say where to sign in, and should treat any balance shown as possibly incomplete. Anyone else still uses the Participant Service Center at 800-999-8786.

Update, October 6 evening: by our 7:58 p.m. Eastern check benefitsforyou.com showed the BenefitsForYou website again, with a participant log-in, instead of the continuity site (item 2026-10-06-benefitsforyou-site-login-returns). TruStage's dashboards still name no sign-in address.

Between our 4:04 p.m. and 7:58 p.m. Eastern checks on October 6, benefitsforyou.com stopped redirecting to TruStage's retirement continuity site at info.benefitsforyou.com, where it had pointed since September 16, and began serving its own page titled “Benefits For You.” Rendered in a browser, the page offers Log in and Register buttons under a “Retirement plan account” heading and lists the Participant Service Center at 800.999.8786. A Financial Professional Portal panel says the service is not currently available and points to the Retirement Solutions resource site.

It is the first time since the outage began that BenefitsForYou.com has shown a log-in. It came a few hours after TruStage's servicing and disbursements dashboards began saying online access is returning in phases for participants who already had an online account, after a required password reset. TruStage has not announced the change on any page this tracker follows. Its dashboards still name no sign-in address, and the continuity site, still online, still says TruStage is working to restore full BenefitsForYou.com access.

This tracker did not try to sign in and cannot say which participants the log-in admits today. The Register button appears even though TruStage's dashboards describe access only for existing accounts. For a credit union: a participant who already had a BenefitsForYou login can try benefitsforyou.com after resetting the password; anyone else still uses the Participant Service Center at 800-999-8786 or participantservicecenter@benefitsforyou.com.

Between our 2:05 p.m. and 4:04 p.m. Eastern checks on October 6, TruStage restamped all three “Latest update” blocks on its outage hub and credit union page “Oct. 6” and rewrote two of them. The policy and contract servicing block now says capabilities continue to become available across life, AD&D, annuity and retirement products, retirement newly named, and that teams are starting to process the backlog of life insurance surrender requests. The disbursements block says capabilities are returning in phases and names the current work: the life surrender backlog, phased issuance of delayed annuity contracts, and wider retirement participant access to account information. A new sentence says recovery remains phased, with backlogs, manual processes and system dependencies still affecting timing, and capabilities varying by product and retirement plan during testing and validation. The claims block's wording did not change.

The servicing and disbursements dashboards carry the same news in more detail. Their life notes tell customers who want to cancel to print and mail the form on the service forms page, to keep expecting delays while the backlog is worked, and that TruStage will honor the date of requests. Their annuity notes drop the month range they had carried since September 18 (more servicing and advisor support returning across September and October on the servicing dashboard, recovery efforts planned through those months on the disbursements dashboard), so TruStage now publishes no forward-looking timing of any kind. The dashboard's annuity numbers, 800-798-5500 for customers and 877-345-4769 for advisors, did not change.

No availability label moved. The credit union page also gained a “Resources for your members” block linking to the claim intake page, the individual consumer FAQs and the life and AD&D service forms page, all pages TruStage already published. The five dated outage pages restamped to October 6, 1:32 p.m. CT with their bodies unchanged.

TruStage does not say which annuity contracts were delayed or when the surrender backlog will clear. A member waiting on either should still expect delay.

Between our 12:04 p.m. and 2:04 p.m. Eastern checks on October 5, TruStage added guidance on qualified domestic relations orders to its BenefitsForYou retirement information site. A QDRO is the court order that assigns part of a participant's retirement benefit to a former spouse or other alternate payee. In the section for defined contribution plans that do not use the Choice Group Variable Annuity, TruStage says it will resume processing QDROs. Plan sponsors are to send future requests through the BenefitsForYou Secure Portal in place of the earlier email submission process; after documents are submitted there, follow-up correspondence comes by email from PlanDocuments@trustage.com, and TruStage asks that no secure or personally identifiable information be sent to that address. Participants are told to start the process through their plan administrator, and sponsors can get TruStage's QDRO procedures and model order from their consultant.

Two plan types get less. For defined contribution plans on the Choice Group Variable Annuity and for defined benefit (pension) plans, TruStage says it can review an unsigned domestic relations order, checking a draft for problems before a court signs it, and sponsors send those drafts through the same secure portal. It cannot process any related transactions or withdrawals for those plans at this time.

The same edit adds a Summary Annual Report note for sponsors. Calendar-year plans that filed Form 5500 before July 31, 2026, were to distribute the report to participants by September 30, and TruStage says it emailed instructions to affected plans on September 22; other plans will hear from TruStage before their own distribution deadline. A credit union that sponsors a calendar-year TruStage plan should confirm it received the September 22 email.

The page says TruStage will resume QDRO processing and gives no start date, so this records a stated plan, not a confirmed restoration. The site carries no “last updated” stamp, so the edit is dated by comparing our captures. No other TruStage surface this tracker follows mentions QDROs or the Summary Annual Report.

Between our 10:05 a.m. and 12:05 p.m. Eastern checks on October 1, TruStage rewrote one answer on trustage.com/outage/business/credit-union. The answer on members who changed or cancelled a policy after their last billing cycle became two. The first now covers policy changes only and says such requests may not yet appear in billing activity and will be honored as of the date received.

The second covers cancellations. It says members who cancel will be removed from automatic recurring billing, but that because of the current processing backlog there may be a gap between receipt of the request and removal from the billing file, and an additional billing attempt could occur in that gap. TruStage says it will refund the premium if that happens, and that cancellations will be honored for the date the request was received.

The refund promise is new on this page; the September 25 servicing dashboard said only that a cancelling member can be taken off automatic billing. A credit union fielding a complaint about a post-cancellation draft can now point to TruStage's stated refund commitment. The page carries no date stamp of its own, so the edit is visible only by comparing captures.

The same sweep showed the shared outage-page stamp moving to October 1, 9:29 a.m. CT on five pages with no body change, and the individual outage page moving its claim-payment-timeline answer from the billing section to the claims section with its wording unchanged.

Between our 10:04 p.m. Eastern check on September 25 and our 6:04 a.m. check on September 26, TruStage restamped the “Latest update” blocks on its outage hub and credit union page from Sept. 18 to Sept. 25 and rewrote all three. The claims block no longer says that all pre-outage GAP claims have been processed except those awaiting required information; it now carries only a note about enhanced online support resources. The servicing and disbursements blocks carry general statements that capabilities continue to return across life, annuity, retirement and executive benefits, with some requests still manual and slow.

On the claims dashboard the payment protection section lost its percentages: approximately 20 percent of post-outage claims processed and an additional 50 percent contacted to gather information. It now says TruStage has begun contacting members or credit unions for information on post-outage claims. The GAP pre-outage sentence remains there. The life and AD&D sections add that teams are implementing document-access tools to reach beneficiary information and historical claim files, and the Bond Suite section says claim-payment, correspondence and reporting tools continue to be restored.

TruStage did not explain the removals. No availability label moved and no completion date appeared. The consumer FAQ's September 15 totals were not touched.

Update, October 6: the claims dashboard removed both the GAP pre-outage sentence and the statement about contacting members or credit unions on post-outage claims; see the October 6 claims dashboard item.

TruStage rewrote the life and AD&D sections of its policy and contract servicing dashboard between our 10:04 p.m. Eastern check on September 25 and our 6:04 a.m. check on September 26. Both now say customers requesting cancellation of eligible policies can be removed from recurring automatic billing while the servicing request is processed. The life section adds that existing cancellation and surrender backlogs remain, that teams have expanded support for those requests, and that customer request dates will be honored even where manual processing slows them.

The mail-in rule stands in shorter form: to change a policy, customers print and mail the form on the outage hub, and TruStage says it cannot make policy changes over the phone. The dashboard also says its individual service hub now has improved navigation and search. The annuity note keeps the September-and-October range for further servicing returns, and the retirement note now says recovery remains focused on restoring participant-account visibility and digital capabilities.

The dashboard does not define which policies are eligible, and TruStage has pulled new guidance back within hours before. A member who has already asked to cancel and is still being drafted should raise it with the Life and AD&D Contact Center.

Update, October 6: TruStage rewrote the life note again. It now says teams are starting to process the backlog of life insurance surrender requests and that TruStage will honor the date of requests; the autobilling sentence remains. The annuity note no longer carries the September-and-October range.

TruStage rewrote the life section of its disbursements status dashboard between our 8:04 p.m. and 10:04 p.m. Eastern checks on September 25. The note still points customers who need a partial withdrawal, a policy loan or a surrender to the service request forms, but it replaces a general line about progress restoring surrender and policy-servicing capabilities with a direct statement that its service team is beginning to process surrender requests. It adds that customers who wish to cancel their policy should use the service form on the outage hub, and keeps the warning that some transactions may require manual processing and take longer than normal.

The row labels did not move: life one-time withdrawals and surrenders are still marked partially available, as they have been since September 18. The same edit added a line to the annuity note saying some requests may take longer than normal to complete, and removed the “New” tags from the retirement and executive benefits sections without changing their text.

At this check the sentence appeared only on the dashboard; the outage hub and the credit union page were unchanged. TruStage has pulled newly published guidance back within hours before, so read this as the company's current statement, not a settled service level. A member with a pending surrender should still expect manual handling and delay.

Update, October 6: the sentence was rewritten, not withdrawn. Both dashboards, the outage hub and the credit union page now say teams are starting to process the backlog of life insurance surrender requests, and the dashboards add that TruStage will honor the date of requests.

In the same September 24 edit to its credit union outage page, TruStage added eight FAQ answers about OpenText Core Content, the service it uses to deliver member-level payment files for lending claims. TruStage says it tried to arrange email alerts for new files but OpenText cannot provide them, so credit unions should check OpenText routinely after receiving an ACH; its goal is to post each file within three business days of the ACH. The answers also say data is encrypted in transit and at rest, that a user's ID is the email address TruStage used to set the account up, and that too many wrong passwords trigger a temporary lockout of about 15 minutes. Other answers cover registration trouble, password requirements, session time-outs and missing registration emails, which TruStage says usually land in spam or junk folders.

This is the first time OpenText appears in the incident material this tracker has recorded. The page does not say when credit unions were enrolled or whether every credit union with lending claims will receive access.

TruStage added the guidance to its credit union outage page between our 12:05 p.m. and 2:05 p.m. Eastern sweeps on September 24. A new notice near the top of the page, marked NEW, asks credit unions not to submit Plastic Card claims at this time, and a new FAQ answer under Other products explains why. Credit unions should hold these claims until further notice and should not send personally identifiable information, including credit card numbers, to TruStage by email. TruStage says it is setting up a secure way to submit these claims and will notify credit unions when it is available. So that policyholders are not penalized by the pause, the time allowed to submit a claim will be extended by the number of days submissions are on hold.

The same guidance first reached this tracker on September 23 through a peer association's resource page, which we logged for staff only because no TruStage surface carried it. TruStage's own page now does, so credit unions can act on it from the source. The page gives no date for the secure process and no revised deadline.

TruStage edited the payroll answer on its BenefitsForYou information site between our 4 p.m. and 6 p.m. Central checks on September 24. The paragraph describing the interim upload process for defined contribution plans that are not on the Choice Group Variable Annuity previously pointed employers to an August 19 email; it now points to emails sent August 19 and September 18 to the eligible plan types. The rest of the answer is unchanged: payroll files sent in good order through automated aggregators such as PayKonnect and Payroll Integrations continue to process as usual, and the payroll team contacts employers when a file is not in good order or needs funding approval.

The site does not describe the contents of the September 18 email, and this tracker has not seen it. Credit unions that sponsor a TruStage retirement plan and upload payroll directly or through MoveIt should confirm they received it.

Between this tracker’s 10:05 a.m. and 12:05 p.m. checks on September 22, TruStage rewrote its retirement outage page and moved the shared outage-family stamp to September 22, 10:23 a.m. CT. The extracted text shrank from about 15,800 to 6,400 characters. What remains is a short recovery paragraph, the status line, two new blocks — one saying retirement plan assets were not impacted and remain invested while some online account and transaction capabilities may stay limited, the other directing readers to the Retirement Solutions resource site for balances, contributions, withdrawals, loans, investments, reporting and interim processes — and a much shorter set of FAQs.

The participant FAQ lost its answers on which services are unavailable, on restoring online 401(k) access, on receiving funds from a retirement account, on lost earnings, and on initiating trades or changing investment elections. The plan sponsor FAQ lost more: system-restoration timing, scheduled installments and annuity distributions, benefit statements, plan-level statements through Matrix, payroll processing split by plan type, payroll templates, continuing enrollment, and the link to the Groom Law white paper. Each section keeps the data-investigation answer and gains one combined answer that repeats only that BenefitsForYou.com remains down. The Mandiant containment answer and its memo link survived a third rewrite untouched.

This is a consolidation, not a withdrawal, and we checked it before saying so. Every removed block appears on the Retirement Solutions continuity site at info.benefitsforyou.com, which this tracker has snapshotted since September 16 and which did not change in the same sweep: the Choice Group Variable Annuity payroll restriction and its non-interest-bearing account, the automated payroll and secure-portal routes, the Groom Law paper, the investment trade and allocation change process, and the service-center numbers. Two read more currently there than they did on the outage page — statements are described as monthly and mailed to all participants, and contributions are adjusted to reflect the earnings that would have occurred on the original check date. One route differs enough to pass on: the continuity site tells participants to call 800-999-8786 for a withdrawal or loan form and return it to the plan sponsor for approval and secure-portal upload, where the outage page had pointed them to email. The retired 844-958-8910 marketing number still sits in the page’s call widget.

Between this tracker’s 12:05 p.m. and 2:05 p.m. checks on September 22, TruStage restructured trustage.com/outage/individual. The heading that read “TruStage is actively investigating a cybersecurity attack” is now “Services and recovery updates for individuals,” and the block beneath it that showed “Status: Investigating” with a “Last Updated” time is gone entirely. The page no longer carries a dated stamp, so it has left the shared-stamp outage family; the other five dated outage pages still read “Investigating.”

The new opening paragraph says that since the attack was detected TruStage has contained the incident and is rebuilding portions of its infrastructure. TruStage dropped containment language from its outage-page lead copy on August 5, and it has not returned elsewhere: as of this check the individual page is the only outage page whose lead says so. It is TruStage’s own statement, not a new Mandiant finding, and it says nothing about whether data was accessed — the page’s data-investigation answer is unchanged and still says that analysis will take additional time.

The rest is reorganization. Life and AD&D service forms and the claim link now sit at the top, and a new “What to know” section lifts five billing answers — payment options and mail-in payments, restored ACH and card billing, what happens to coverage when a payment cannot be made, past-due notices, and drafted premiums — out of the FAQ list, with their wording unchanged. The separate links to the annuities and Retirement Solutions support pages were removed from the body. The contact line and hours moved to a “Still have questions?” block and did not change: 1-800-779-5433, weekdays 8:00 a.m. to 5:00 p.m. CT and Saturdays 9:00 a.m. to 1:00 p.m. CT, five occurrences as before.

Verified against the live page at this check, not only the snapshot. Nothing here changes service status, coverage, or any number a credit union gives members; it follows the same pattern as the retirement page consolidation this morning.

Between this tracker's 4:05 p.m. and 7:05 p.m. ET checks on September 21, TruStage added an “Annuity RMD form” block to the withdrawal and surrender requests section of its annuity outage page. The page describes it as a way to request a one-time required minimum distribution or enroll in automatic RMD distributions, completed with TruStage's forms partner AssureSign — the same electronic-signature route already used for partial withdrawals, surrenders, direct deposit changes, application cancellations and right-to-examine requests.

One detail is worth passing to staff who field these calls: unlike every neighboring block, which offers separate single-owner and joint-owner versions, the RMD block carries a single link labeled “Required minimum distribution form.” TruStage does not say on the page how jointly owned contracts should use it.

The page already listed a downloadable RMD form lower down, grouped with the systematic withdrawal and direct deposit PDFs; that entry is unchanged. The addition is therefore an electronic path to a request that previously had to be printed, signed and mailed, not a new capability.

The same edit moved the shared “Last Updated” stamp on all six dated outage pages from September 18, 9:01 a.m. CT to September 21, 3:37 p.m. CT. Annuity is the only one of the six whose body changed. Nothing else moved on it: the status still reads “Investigating,” the annuity contact center line is still 855.591.9027 weekdays 8:00 a.m. to 5:00 p.m. CT, and the page still tells customers they may have difficulty accessing account information, completing transactions or submitting requests online. As with the other outage forms, this is a workaround while online servicing is down, and TruStage publishes no turnaround time for requests submitted on it.

TruStage published the figure on the afternoon of September 18, cut it from the outage hub that evening, and has now removed it from the credit union page as well. Our 6:01 p.m. sweep on September 18 still found the credit union page reporting more than 10,000 life and AD&D claims paid, representing more than $100 million in benefits delivered; the 6:45 a.m. sweep on September 19 found the bullet gone from both pages. The same edit removed the credit union page's clause saying recurring disability and unemployment claim backlogs have been cleared — the hub and the claims dashboard had dropped it the evening before — so that sentence is now off every TruStage surface we track. The two sweeps are about twelve hours apart because the September 18 evening checks did not run, so we cannot place the edit more precisely than overnight. Neither page's “Latest update – Sept. 18” stamp moved with it.

What remains in the claims block on both pages is one sentence: all pre-outage GAP claims have been processed except those awaiting required information. No claims total of any kind now appears on the hub or the credit union page. The only claims figures TruStage still publishes are elsewhere — on its consumer FAQ, untouched since September 15, over $60 million in Individual Life claims and more than $44 million in lending and property-and-casualty claims paid since the attack; and on its claims dashboard, percentages for payment protection only, roughly 20 percent of post-outage claims processed with the member or the credit union contacted to gather information on an additional 50 percent of that inventory.

The same edit trimmed the policy and contract servicing block on both pages. It removed the sentence listing what support is available — account balance information, loan and distribution support for eligible retirement plans, investment change requests for eligible plans, and select annuity servicing including withdrawals, surrenders, direct deposit updates and application cancellations — and the sentence saying some servicing requests still require interim or manual processes. That detail has not been withdrawn from the site: both statements still appear on the policy servicing and disbursements dashboards. What changed is where the information lives, not whether TruStage stands behind it. The remaining bullet is unchanged and says additional policy-servicing capabilities are being restored through contact-center-supported processes.

For a credit union the practical effect is that a figure a member or a board may have been given on September 18 can no longer be found on the page it came from. It is the third TruStage figure this month to be published and pulled back inside about a day, after the annuity transaction pointers on September 11 and the hub's own narrowing of this same bullet on September 18. Quote TruStage totals with the date and the page you read them on, and re-check the page before repeating them. No availability label moved in this edit, and no completion date returned.

Update, October 6: the dashboards' retirement notes were rewritten, and the list of available retirement support no longer appears on either dashboard. TruStage's retirement continuity site still describes the distribution, loan, contribution, investment and installment-payment processes.

TruStage published new claims figures on its outage hub and its credit union outage page on the afternoon of September 18, and edited the hub again the same evening. After that evening edit the hub bullet read that more than 10,000 life, AD&D and pre-planning claims have been paid. The $100 million in benefits delivered is gone, “pre-planning” has been added to the claim category, and the sentence saying recurring disability and unemployment claim backlogs have been cleared has been dropped. The credit union page was not touched in that second edit and still carries all three.

The claims dashboard was edited alongside the hub. It dropped its own backlogs sentence and re-scoped its post-outage percentages: they now read approximately 20 percent of post-outage claims processed, with the member or the credit union contacted to gather information on an additional 50 percent of the post-outage inventory — previously worded as claims submitted after July 11, and as contact made to file payment on the additional 50 percent.

Both the hub and the credit union page also dropped the sentence added earlier that day saying death claims support is now available as part of retirement and annuity servicing. The capability itself is still described on the annuity outage page and on both the claims and servicing dashboards; what came off is the announcement.

For a credit union answering a member, the practical effect on September 18 was that TruStage's own two summary pages gave different accounts of the same day's progress, neither dated more precisely than “Sept. 18.” Overnight the disagreement resolved by deletion: both pages dropped the bullet, and neither carries a claims total as of the morning of September 19 (see 2026-09-19-trustage-drops-claims-totals-from-summary-pages). Quote a figure with the page and date it came from, and check the page again before repeating it.

TruStage rewrote its disbursements status dashboard on the afternoon of September 18 (caught at our 6 p.m. check). The life section headline and the one-time withdrawal and surrender rows under it all changed from unavailable to partially available. Every one of the 252 snapshots we have taken of that page since it appeared on August 20 had read unavailable, so this is the first upgrade of those rows in the incident.

The note above them was rewritten with it. Where it had said only that customers needing a partial withdrawal, a policy loan or a surrender can get service request forms, it now adds that teams are making progress restoring surrender and policy-servicing capabilities through contact-center-supported processes while system capabilities continue to be restored, and that some transactions may require manual processing and take longer than normal.

The other sections were reworded without moving their labels. The annuity note adds that recovery efforts planned through September and October are expected to expand support for customers and financial professionals. The retirement note now says participants may request loans, distributions and other eligible plan transactions, and that many participants can obtain account balance information while digital-access capabilities are restored. The executive benefits section gained a “New” tag and a line saying established partner processes remain available.

Read “partially available” as TruStage's own label, not as a promise about any one request: it is the same label GAP and payment protection claims have carried for weeks while processing times ran long. A member who needs a withdrawal, a policy loan or a surrender should still expect manual handling and delay, and the forms route on the individual outage page remains the published path.

The life section of TruStage's policy and contract servicing dashboard was rewritten on September 18. It now tells customers who want to change, update or cancel a policy to use the service request form at the link, and says that while representatives can assist with many policy inquiries, they cannot currently update or make policy changes over the phone — customers should access the form, sign it and mail it in. TruStage also says teams continue making progress restoring surrender, cancellation, beneficiary-change and other policy-servicing requests through available support channels.

The annuity row of the same dashboard now says direct-deposit servicing, application cancellation support, withdrawal processing, surrender request processing and annuity death claim support are available through continuity solutions, and that additional annuity servicing and advisor-support capabilities are expected to continue returning through phased recovery efforts underway across September and October. That month range is the first forward-looking timeframe TruStage has published on any surface since it withdrew its mid-September claims target on September 11. It attaches to annuity servicing rather than claims, and it names no specific capability and no date.

The retirement row dropped the flat sentence “Digital access remains unavailable as recovery efforts continue” and now says progress continues toward expanded participant account visibility and digital-access capabilities while some retirement processes remain manual. That is a softening of wording, not an announcement of restoration: TruStage's retirement continuity site still says it is working to restore full BenefitsForYou.com access, and participants still cannot log in.

The outage hub and credit union page carry the roll-up versions of the same update — death claim support now available as part of retirement and annuity servicing, and direct-deposit servicing for annuity customers now available. No availability label moved on any dashboard; the annuity payout row on the claims dashboard still reads unavailable, and the disbursements dashboard headline still reads unavailable.

On the afternoon of September 18 TruStage restamped its outage hub and its credit union outage page “Latest update – Sept. 18” and rewrote the claims block on both. The new wording says more than 10,000 life and AD&D claims have been paid, representing more than $100 million in benefits delivered, that all pre-outage GAP claims have been processed except for claims awaiting required information, and that recurring disability and unemployment claim backlogs have been cleared.

The claims dashboard was rewritten in the same edit and carries the first post-outage percentages of the incident, in its payment protection section — credit insurance, debt protection and GAP. TruStage says it has processed approximately 20 percent of claims submitted after July 11, and that it has contacted the member or the credit union to gather information needed to pay an additional 50 percent of that post-outage inventory. The life and AD&D sections of the dashboard dropped their dollar figures entirely and now say only that teams continue working through pre-outage and post-outage claims.

Read the new headline figure carefully. The $44 million total it replaces was explicitly pre-outage life and AD&D; the $100 million sentence carries no such qualifier and TruStage does not say what population or period it covers, so it is not a like-for-like increase. Removed in the same edit, from every TruStage surface we track, are the $6.6 million credit insurance and debt protection life figure and the sentence saying those payments accounted for 100 percent of outstanding pre-outage debt protection life and credit life claims — the only completion TruStage had claimed in this incident. Nothing on its surfaces says that completion no longer stands; it simply stopped being published.

The consumer FAQ's separate September 15 totals were not touched: over $60 million in Individual Life claims and more than $44 million in lending and property-and-casualty claims paid since the attack. Those count different work from the hub figure and TruStage nowhere reconciles the two. No claims availability label moved on any dashboard, and no completion date returned.

TruStage edited the hub again the same evening, cutting the $100 million figure and the backlogs sentence from it while leaving the credit union page as published. That second edit is recorded separately in 2026-09-18-trustage-hub-narrows-claims-figures. Overnight it removed the bullet from the credit union page as well, so none of the figures described here survives on a TruStage summary page; see 2026-09-19-trustage-drops-claims-totals-from-summary-pages.

Between this tracker's 10:00 a.m. and 12:00 p.m. Eastern sweeps on September 17, TruStage swapped out the marketing answer on trustage.com/outage/business/credit-union, the page written for credit unions. The question that had asked whether the call center could fulfill leads from August direct mail is gone, and with it the answer saying TruStage planned to mail only Auto Insurance offers that month. In its place is a broader question about whether TruStage is marketing Consumer Insurance by direct mail or email at all.

The new answer sets a date for the first time: direct mail and email marketing for AD&D, Life and Auto Insurance products is paused through November. TruStage says future marketing activity is being evaluated as part of its recovery and resiliency work, weighed against member experience, operational readiness and business continuity, and that members may still see marketing already distributed through the credit union channel — website banners, branch materials, brochures and other collateral. No restart date is given beyond the November boundary, and TruStage does not say whether "through November" means the pause lifts at the start of December or is simply the horizon it will commit to.

What a credit union should not read into this: the products themselves are not paused. The adjacent answer on the same page is unchanged and still says members can get Auto & Home quotes, buy coverage, have policies serviced and reach claims support through the Liberty Mutual and Polly partnership without disruption. What stops is outbound acquisition marketing, and with it the flow of leads a credit union might have planned around this fall.

One consequence is visible on the page itself and worth raising with staff. TruStage's route to a new AD&D, Simple Issue Term or Simple Issue Whole Life policy is still the paper application inside a TruStage direct mail offer — that answer is unchanged, and it says explicitly that these policies cannot be started through the call center or on TruStage.com. With AD&D and life direct mail now paused, a member who has not already received a mailing has no published way to apply for those products. TruStage has not addressed that combination anywhere this tracker sweeps.

In the same edit the credit union page picked up the three claims-pacing answers TruStage added to its individual outage page on the afternoon of September 16 — why it cannot give claim-specific payment timelines, why some claims move faster than others, and why it asks for more information after a claim is filed. The wording matches the individual page exactly; this is the usual page-by-page rollout rather than new content. The older line saying product-specific claim payment timelines are not available still stands above it on this page and on the consumer FAQ. The credit union page remains undated, so nothing on it signals that any of this changed; the six dated outage pages moved their shared stamp to September 17 at 9:33 a.m. CT with their bodies untouched.

Statements first, because it is the answer a plan sponsor is most likely to be asked about. For defined contribution plans recordkept on Matrix — 401(k), 403(b), governmental and tax-exempt 457(b) and deferred compensation plans, meaning those not using TruStage's Choice Group Variable Annuity — statements are being processed and mailed to every participant, including those who had elected electronic delivery, and TruStage says it will send monthly statements by mail instead of quarterly to participants and sponsors beginning with the 8/31/2026 month-end. For defined contribution plans that do use the Choice Group Variable Annuity, the 6/30/2026 statements were mailed to all participants with a balance on file and TruStage says it is working to restore normal statement processing. TruStage's retirement outage page still describes quarterly statements mailing on the normal schedule for most plans; the monthly cadence appears only on the new site.

The site also addresses a plan type the outage page does not. For defined benefit and pension plans, monthly annuity and installment payments established before July 2026 are being paid, but TruStage says it cannot process new benefit calculation or payment requests and will give an update when that service is available. Pension assets are described as secure and still invested, and participant benefit statement processing will resume at a later date. The phrase “defined benefit” appears on no TruStage page this tracker follows, so a credit union sponsoring or referring a pension plan had no published TruStage answer before today.

On required minimum distributions, RMD-age participants with annuity or installment payments already established keep receiving them on the normal schedule, and third-party administrators and RMD-age participants in plans that can use the interim withdrawal process may request distributions through it. For plans that cannot, TruStage notes that any remaining 2026 required minimum distributions are not due until December 31, 2026, and says that as the deadline approaches it or the plan's TPA will contact RMD-age participants who still owe one and will process the distribution automatically if the participant makes no election. On plan reporting: Form 5500 preparation and filing continues, TruStage files Form 5558 as usual to extend Form 5500 deadlines by two and a half months and will post a copy once BenefitsForYou is available, the Auditor's Toolbox reaches audited plans and TPAs through a secure portal with instructions emailed to affected plans, and administrators of Matrix-recordkept plans sign Form 5500 by logging in to the Relius Government Forms site. None of Form 5558, the Auditor's Toolbox or Relius appears on any other TruStage surface tracked here.

Two cautions on how to use this. The site carries no “last updated” stamp and no dated news section, so these answers can be dated no more precisely than the day they first appeared, and a later edit will be visible only as a difference from today's snapshot. Much of the rest of the site restates guidance already published on the retirement outage page — the interim withdrawal and investment-change processes, the payroll split between Matrix-recordkept and Choice Group Variable Annuity plans, and the Groom Law white paper on delayed payroll submissions — and this item records only what is new.

This tracker has watched where benefitsforyou.com resolves since August 18, because the redirect is the cleanest available tripwire for the retirement portal coming back. On all 255 checks before today it returned TruStage's retirement outage page. Between the 7:56 a.m. and 11:45 a.m. sweeps on September 16 it changed for the first time: the domain now resolves to info.benefitsforyou.com, a site titled “Retirement solutions.” TruStage announced the move on none of the pages this tracker follows, and the retirement outage page itself is byte-identical to this morning.

The new site is a continuity guide rather than an account portal. A visitor first picks a plan type — defined contribution covering 401(k), 403(b) and 457(b) plans, or defined benefit and pension — then a role, either sponsor, financial professional or third-party administrator, or participant. Each combination opens topic answers on balances, contributions, withdrawals, investments, reporting, contacting TruStage, and website status. The contact block gives the Retirement Service Center at 844-999-2677 and retirementservicecenter@benefitsforyou.com for sponsors and TPAs, and the Participant Service Center at 800-999-8786 and participantservicecenter@benefitsforyou.com for participants, both Monday through Friday, 8:00 a.m. to 5:00 p.m. CT, with a warning that waits may run longer than usual. Both numbers already appear on TruStage's retirement outage page and its policy-servicing dashboard, so a credit union that recorded them has nothing to change.

Read the change carefully before repeating it to anyone. The site's own website-status answer says TruStage is still working to restore full BenefitsForYou.com access. Its only portal link, portal.benefitsforyou.com, is described as the route by which participants in TruStage's Pooled Employer Plan submit a completed interim withdrawal or loan form — document submission, not account access. TruStage's policy-servicing dashboard, fetched in the same sweep and unchanged, still states that digital access remains unavailable as recovery continues. The service board on this page therefore keeps retirement plan servicing at disrupted.

What a credit union should take from it: staff or members who reach BenefitsForYou.com now land on a different page than they did this morning, and the guidance there is sorted by plan type in a way the outage page is not. The retirement outage page at trustage.com/outage/retirement is unchanged and still the dated official surface. This tracker now snapshots the new site every sweep, so a further change — including the login surface the watcher was built to catch — is reported rather than inferred.

Update, October 6: TruStage's servicing and disbursements dashboards began saying BenefitsForYou online access is returning in phases for participants who already had an online account, after a password reset. benefitsforyou.com still opened the continuity site at that check, and the site still said full access was not restored.

Update, October 6 evening: by our 7:58 p.m. Eastern check benefitsforyou.com no longer opened the continuity site. It served the BenefitsForYou website with participant log-in and registration buttons (item 2026-10-06-benefitsforyou-site-login-returns). The continuity site remains online at info.benefitsforyou.com.

Between this tracker's 11:45 a.m. and 4:18 p.m. Eastern checks on September 16, the telephone number on trustage.com/outage/individual/service-forms changed from 855-591-9026 to 1-800-779-5433 in all four places a reader sees it — twice in the page header and twice in the “Give us a call” block at the foot. All four click-to-call links were re-pointed with it, and 855-591-9026 survives on the page only inside the site-wide schema.org contact markup, which is not offered to a reader as a number to dial. Nothing else on the page moved: the mail-in instructions, the AD&D service request and beneficiary change forms, and the notice that fax is unavailable are byte-identical to this morning.

This closes a split this tracker flagged on September 15. TruStage swapped the individual outage page to its Life and AD&D Contact Center number that afternoon but left this sub-page on the old one, so both numbers stood on TruStage's own pages for a day. Across the TruStage surfaces this tracker sweeps, 855-591-9026 now appears in reader-facing copy on one page only, the variable universal life FAQ, where it occurs three times. The new number stands on three: the individual outage page, this service-forms page, and the policy and contract servicing dashboard.

Two cautions on reading the number here. This page carries no outage contact paragraph and no “Last Updated” stamp, so the number is the page's templated header and call-widget line rather than a dated instruction about the outage, and the change can be dated no more precisely than the window above. The hours printed beneath it — Monday to Friday, 7:00 a.m. to 9:00 p.m. CT, Saturday 8:00 a.m. to 4:00 p.m. CT — belong to TruStage's general licensed-agent widget, not to the outage line. The outage hours TruStage publishes for this number are on the individual outage page: weekdays 8:00 a.m. to 5:00 p.m. CT and Saturdays 9:00 a.m. to 1:00 p.m. CT. A credit union pointing members here should quote those.

TruStage announced the change on none of the pages this tracker follows. The six dated outage pages re-stamped to September 16, 2:12 p.m. CT in the same window with their bodies untouched.

Between this tracker's 4:18 p.m. and 6:00 p.m. Eastern checks on September 16, three question-and-answer blocks appeared on trustage.com/outage/individual. One sits under Billing and payments — why TruStage cannot provide claim payment timelines — and two under Claims: why some claims are moving more quickly than others, and why TruStage asks for more information after a claim has already been submitted. Nothing was removed and no other line on the page moved; a set comparison of the two snapshots shows the three blocks as pure additions.

The answers are explanatory rather than operational. On timelines, TruStage says that even under normal operations some individual claims are more complex and need different levels of review, documentation, validation or investigation, and that because of those differences it cannot give claim-specific payment timelines. On pacing, it says product, claim type, documentation requirements and processing capability all affect how a claim moves through review and payment. On follow-up requests, it says some claims need additional information before they can move into review and adjudication, and that collecting complete information and validating coverage helps claims be processed accurately.

All three questions and all three answers are new to every TruStage surface this tracker follows — none appears in any snapshot taken since July. The older sentence saying product-specific claim payment timelines are not available is a different line and still stands on the consumer FAQ and the credit union outage page; the new answer gives a reason where that line gave none. Nothing here is a date, a total, or a restored capability, and no availability label moved.

One dating caution. The page's stamp still reads September 16, 2026, 2:12 p.m. CT, the value it carried at the 4:18 p.m. check, so TruStage published this content without advancing the stamp. The change can be dated no more precisely than the window between the two checks.

TruStage added the same guidance to its claims answers on trustage.com/outage/business/credit-union and trustage.com/outage/individual in this afternoon's edit: customers can report a new claim online, provide claim-related information or receive guidance on next steps, and should not file a duplicate claim if one has already been submitted. The wording differs only in person between the two pages.

The instruction is small but it is the first time TruStage has told customers plainly not to resubmit, and it is the question a credit union is most likely to be asked by a member who filed weeks ago and has heard nothing. The backlog language around it is unchanged — claims remain a priority, TruStage continues working through backlogs, and it still publishes no date for finishing them.

What the sentence does not do is give anyone a way to check on a claim already filed. TruStage's representatives still cannot see individual account information on these pages' own account, so a member who wants status has no self-service route; the practical advice remains to log the inquiry and follow it until the claim is actually paid.

Three payment answers on trustage.com/outage/business/credit-union changed in this afternoon's edit, and one of them narrows a capability TruStage had already claimed. The billing-restoration answer previously said recurring monthly ACH and, most recently, credit card billing had resumed for certain Life, AD&D and Preplanning customers. It now says recurring monthly ACH and certain recurring credit card billing have resumed for those customers. The qualifier is new, and it does the work: card billing is no longer described as resumed as a class, only in part, and TruStage does not say which cards or customers are inside the part that works.

The answer explaining why an August premium may have drafted when July's did not was tightened in the same direction, from billings that are beginning to resume to billing that is resuming. Neither edit changes what a member should do, but both change what a credit union can safely tell one — if you have been saying card billing is back, say some of it is.

The third answer gains detail rather than losing it. Where TruStage previously said only that some payment processing had been restored and some options remained limited, it now adds that members may use available payment options or mail a payment following the instructions on the outage hub, that one-time payments by phone and certain paper-billing functions are still unavailable, and that coverage protections and grace-period accommodations remain in place. That last clause is the reassurance to lead with at the counter; the mail route is the workaround this tracker recorded on September 10, when TruStage published its lockbox addresses.

The page carries no date stamp of its own, so the edit is visible only by comparison with the previous capture.

TruStage extended the “When will this be resolved?” answer on trustage.com/outage/business/credit-union and trustage.com/outage/individual in this afternoon's edit. The existing paragraph is untouched — phased recovery, a broad portion of the technology environment affected, systems restored carefully, some capabilities needing more time. Appended to it, word for word, is the sentence that appeared on the wealth management solutions page on September 11 and on the general business page on September 14: that recovery is increasingly moving from access to execution, with more customers and members reaching TruStage, more claims moving through the process and more transactions being completed, and that some services continue to rely on interim or manual processes.

The propagation is the news, not the words. A characterization that sat on one page for three days is now on four, including the two pages a credit union and its members are most likely to read, which is the shape TruStage's language takes once it becomes the company's standard description rather than a trial.

The caveat travels in the same sentence and remains the operative half for a credit union: interim and manual processes are still in use, and those are what turnaround times and error rates depend on. The sentence names no volume, no completion target and no service that has moved from one state to the other, so it cannot be used to tell a member that a particular capability now works. TruStage's three service status dashboards remain the concrete reference for that.

At this check the sentence is on the wealth management solutions, business, credit union and individual pages; the annuity, preplanning and retirement answers still end at the older wording.

TruStage rewrote the containment answer on trustage.com/outage/business/credit-union in an edit captured at this tracker's 4:01 p.m. Eastern check. The question is unchanged — whether a cybersecurity expert has spoken to containment and to whether TruStage is operating in a clean, safe environment as systems return. The answer now says Mandiant updated its Investigation Memo on August 27 to reflect the latest forensic evidence it reviewed, and that on the basis of its investigation Mandiant found no evidence of threat actor activity in the affected environments since July 11, when TruStage identified the incident and acted to contain and remediate it.

This is the credit union–facing page, so the wording matters more here than on the product pages that took it first. The construction is the same one TruStage rolled onto the annuity, business and wealth management pages between September 14 and 15: it reports an absence of evidence within a defined investigation, and it attributes the containment action to TruStage rather than having Mandiant certify the environment. The earlier answer on this page made the same point in narrower terms and pointed the reader to the memo; the affirmative formulation that TruStage used in early September — that the environment was clean and the incident contained — is now off every US outage page and survives only on the Canadian FAQ.

The practical reading for a credit union is unchanged by the rewrite, and that is the point worth passing on: no evidence of activity within the scope of an investigation is not a statement that no data was accessed, and TruStage continues to call conclusions on that question premature. The memo is still the only inspectable document behind the claim, and it does not define its own scope.

With this edit the preplanning page was the only US outage page still carrying the September 3 wording, and it took the rewrite itself that evening — see the September 15 preplanning item. The retirement page carries an older answer again, which names Mandiant and links the memo without a finding. Page lists in this record are re-checked every cycle while the rollout is in flight.

Between this tracker's 2:01 p.m. and 4:01 p.m. Eastern checks on September 15, TruStage changed the telephone number on trustage.com/outage/individual and re-stamped the page September 15, 1:42 p.m. Central. The contact sentence now tells individual policyholders to call 800-779-5433; since September 2 it had read 855-591-9026. The swap is thorough rather than partial: the visible copy, the “Give us a call” block lower on the page and all five click-to-call links now carry the new number, and 855-591-9026 survives only inside the page's schema.org contact markup, which is not offered to a reader as a number to dial.

Nothing else in the paragraph moved. The published hours are still weekdays 8:00 a.m. to 5:00 p.m. Central and Saturday 9:00 a.m. to 1:00 p.m. Central, and the page still says representatives have very limited access to account information and cannot process transactions or submit requests.

The new number is not new to TruStage. It is the Life and AD&D Contact Center line that TruStage's policy and contract servicing dashboard has published since August 27, and that dashboard still carries it, unchanged in this sweep. What has changed is which number the incident-specific page for individual policyholders sends people to — from a line opened for the outage to the standing servicing line. TruStage has not said why, and this tracker is not inferring a reason.

Two cautions before you update your own material. The swap has not reached TruStage's other individual-facing surfaces: the service forms sub-page at trustage.com/outage/individual/service-forms and the variable universal life product FAQ both still publish 855-591-9026, so two different numbers are live on TruStage pages for the same audience as of this check. And TruStage announced none of it — no newsroom release accompanied the edit, and the page's own stamp is the only public marker. We cannot test whether the old line still answers, so treat 800-779-5433 as the number TruStage now publishes for individual policyholders, not as proof the old one is dead.

TruStage rewrote the two claims answers on its consumer service-disruption FAQ at engage.trustage.com in an edit this tracker captured at its 10:01 p.m. Eastern check. The substantive addition is a sentence of figures: since the cybersecurity attack, over $60 million in Individual Life claims and more than $44 million in lending and property-and-casualty claims have been paid. This is the first time either category has appeared on a TruStage-owned surface. Both numbers were previously visible only through a peer association — CrossState's September 9 rewrite relayed them as more than $36 million in Individual Life and more than $33 million in lending and property and casualty, which our record logged for staff only because no TruStage page carried them. TruStage now does, and both have risen substantially in the six days since.

The figure a credit union is most likely to trip over is $44 million, because it now means two different things on TruStage's own pages. On the consumer FAQ it is lending and property-and-casualty claims. On the outage hub, the credit union outage page and the claims status dashboard it is pre-outage Life and AD&D claims — wording all three still carry unchanged. These are separate cuts of separate work and TruStage does not reconcile them anywhere it publishes. Do not add the totals together, and check which page a figure came from before quoting it to a member or a board.

The same edit moved three other things. TruStage now says review of GAP claims submitted after July 11 has begun — language it deleted from its claims dashboard on September 11, returning here on the consumer FAQ only; the dashboard still does not carry it. The sentence saying Life and AD&D processing would take claims pending at the time of the outage before claims received afterward is gone from this page, though the credit union outage page still states that ordering. And the claims answer took the duplicate-claim guidance TruStage added to the credit union and individual pages earlier the same day: report a new claim online, and do not file a second one if a claim is already in.

Nothing here is a completion date. TruStage still says product-specific claim payment timelines are not available, still says some claims may need additional documentation or manual processing, and has published no date for finishing any claim since September 11. Read the totals as progress. One verification note worth carrying: the page's own “Last Updated” line did not move with this edit — it still reads September 15, 11:15 a.m. Central, the value it carried six hours earlier — so the stamp is not a reliable signal that the content changed.

TruStage rewrote the containment answer on trustage.com/outage/preneed in the same evening edit that changed its consumer FAQ. The question is unchanged — whether a cybersecurity expert has addressed containment and whether TruStage is operating in a clean, safe environment as systems return to service. The answer now says Mandiant updated its Investigation Memo on August 27 to reflect the latest forensic evidence it reviewed, and that on the basis of its investigation Mandiant found no evidence of threat actor activity in the affected environments since July 11, when TruStage identified the incident and acted to contain and remediate it.

This completes a rollout our record has been tracking page by page since September 2. Five US outage pages now carry the rewritten answer: annuity, business, wealth management solutions, credit union and preplanning. The retirement page carries an older answer again, which names Mandiant and links the memo without stating a finding, and the individual page carries no Mandiant answer at all. The affirmative formulation TruStage used briefly in early September — that the operating environment was clean and the incident contained — is off every US page and survives only on the Canadian preplanning FAQ.

The practical reading for a credit union does not change with the wording, and that is the part worth passing on. No evidence of threat actor activity within the scope of an investigation is not a finding that no data was accessed, and TruStage's own answer on the data question, which sits directly above this one on the same page, still says the forensic and data-impact analysis is continuing and is expected to take additional time. The memo remains the only inspectable document behind the claim, and it does not define its own scope.

The same evening edit replaced the claim-filing answer on trustage.com/outage/preneed. Where the page had carried the generic individual-coverage wording used across TruStage's outage family — that a claim would be processed and paid under applicable policy terms as capabilities were restored — it now names who starts the claim: US funeral homes should submit the initial notification of loss, with a link to do so, and beneficiaries can also submit a notification of loss. TruStage adds that some claim processing limitations will remain in place while it recovers its servicing systems. For a credit union fielding a preplanning question this is a more useful answer than the one it replaced, because it routes the first step rather than describing a policy.

Two answers were appended below. The first says payment options remain limited, online one-time payments are unavailable, and TruStage is unable to mail bills or provide a total past-due balance — while repeating that coverage will not be lost over an inability to pay during the disruption and that more than one premium may come due during the extended grace period. That answer already sat on the individual outage page; this is its propagation to preplanning, not new guidance.

The second is new to this page and names both investigating firms: the investigation remains ongoing, supported by Mandiant and Epiq Global, and if TruStage determines that customer, employee or other affected data has been impacted its intent is to work with partners on any communication needed, supporting them through notification or reporting requirements. Until September 15 the credit union outage page was the only TruStage-owned page naming Epiq Global; preplanning is the second. The substance is unchanged from what TruStage has said since August — partners would be told first, and no determination has been announced — but a credit union asked whether members will be notified directly can now point at a consumer-facing page for the answer rather than a partner one.

In the same evening edit that rewrote its containment answer, TruStage extended the “When will this be resolved?” answer on trustage.com/outage/business. The existing paragraph is untouched: phased recovery, a broad portion of the technology environment affected, systems restored carefully, some capabilities needing more time. Appended to it, word for word, is the sentence that appeared on the wealth management solutions page on September 11 — that recovery is increasingly moving “from access to execution,” with more customers and members reaching TruStage, more claims moving through the process and more transactions being completed, and that some services continue to rely on interim or manual processes.

The significance is the propagation, not the words. Until now this was a single-page characterization, which is the shape TruStage language takes when it is being tried out; a second page suggests it is becoming the company's standard description of where recovery stands. The caveat travels in the same sentence and is the operative half for a credit union: interim and manual processes are still in use, which is what turnaround times and error rates depend on.

What the sentence still does not carry is any number, date or product scope. It names no volumes, no completion target and no service that has moved from one state to the other, so it cannot be used to tell a member that a specific capability is now working. TruStage's three service status dashboards remain the concrete reference for that. At the time of this check the sentence was on the wealth management solutions and business pages only.

Update, September 15: it propagated again the following afternoon, to the credit union and individual pages. The annuity, preplanning and retirement answers still end at the older wording. See the September 15 entry.

Between this tracker's 4:01 p.m. and 7:50 p.m. checks on September 14, TruStage rewrote the containment answer on two more outage pages. On trustage.com/outage/business/wealth-management-solutions the affirmative sentence reporting that Mandiant found TruStage's “operating environment is clean, the incident is contained” and saw no indication of active intrusion is gone; on trustage.com/outage/business the narrower September 3 answer is gone. Both now carry the wording the annuity page took earlier the same afternoon: that Mandiant updated its investigation memo on August 27 to reflect the forensic evidence reviewed, and found no evidence of threat-actor activity in the affected environments since July 11, 2026, the date TruStage says it identified the incident and acted to contain and remediate it.

The wealth management solutions page was the last US outage page carrying the affirmative finding. Checked page by page against the live pages at this sweep, that sentence now appears zero times anywhere on trustage.com. It published on the annuity page on September 11, spread to wealth management solutions the same afternoon, and was withdrawn from both within three days. The strongest public statement that the incident is over has been taken back off the site. It survives on the Canadian affiliate's FAQ at trustage.ca, where TruStage has stated the clean-and-contained conclusion in its own voice since August 24 — a different company statement on a different regulator's turf, and not a substitute for a US page.

Three answers to the same question are now live across the outage family. The annuity, business and wealth management solutions pages carry the new no-evidence wording. The credit union and preplanning pages carry the September 3 wording, which reports that Mandiant has not identified any threat-actor activity within the environments in the scope of its investigation and points to the memo dated August 27. The retirement page still carries the oldest version, which opens with an affirmative yes and links an undated memo, and the individual page carries no Mandiant answer at all. The page that matters most to our members is the credit union page, and it is not one of the three that moved.

Two notes for anyone checking these pages directly. The outage family's shared “Last Updated” stamp did not move for this edit: all six dated pages still read September 14, 1:33 p.m. Central, the value set in the afternoon edit hours earlier. That is the second time in four days a body change has landed without moving the stamp, so the stamp cannot be used to tell whether a page has been edited. And the memo reference was respelled rather than dropped — the business page previously printed the memo as dated August 27 and now says the memo was updated on August 27. The date is the same and remains the only version marker TruStage publishes, because the link behind it is an undated short URL.

For a credit union nothing here changes service status, member guidance or any contact detail. It matters because this is the answer a member, a board or an examiner is most likely to be shown when they ask whether the incident is over. Anyone who quoted the clean-and-contained sentence from either page should check the page again before repeating it. TruStage has not said why the wording changed, and this tracker is not inferring a reason.

Update, September 15: the credit union page moved off the September 3 wording that afternoon and took the rewritten “no evidence” answer, leaving preplanning as the only US outage page still on the older construction. The finding recorded above is unaffected — no US page has carried the affirmative clean-and-contained sentence since September 14, and the Canadian FAQ still does. See the September 15 entry.

Between this tracker's 2:01 p.m. and 4:01 p.m. checks on September 14, TruStage rewrote the containment answer on trustage.com/outage/annuity for the third time in twelve days. The question above it is unchanged and still asks whether a cybersecurity expert has provided information on whether the incident is contained and whether TruStage is operating in a clean and safe environment. The answer the page carried from September 11 until this afternoon reported an affirmative finding attributed to Mandiant — that the “operating environment is clean, the incident is contained” and no active intrusion was indicated. That sentence is gone. Checked against the live page, the withdrawn wording now appears zero times.

What replaced it is narrower on three counts, and the differences are the substance of the change. TruStage now opens by saying Mandiant updated its investigation memo on August 27 to reflect the forensic evidence reviewed, then reports that Mandiant found no evidence of threat-actor activity in the affected environments since July 11, 2026 — the date TruStage says it identified the incident and acted to contain and remediate it. First, a finding of no evidence is not the same statement as a finding that the environment is clean. Second, containment now appears as a description of what TruStage itself did in July, not as a conclusion Mandiant reached. Third, the scope phrase changed: earlier wording confined the finding to the environments within the scope of Mandiant's investigation, and the new sentence refers instead to the affected environments, a boundary TruStage has not defined publicly. The link to the memo survives; it is anchored on the memo's name and still points at TruStage's undated short URL, so the printed August 27 date remains the only version marker.

The outage family now carries four different answers to the same question, each verified against the live pages at this check. The wealth management solutions page is the only US outage page still reporting the affirmative clean-and-contained finding. The business, credit union and preplanning pages carry the narrower September 3 wording with the August 27 memo reference. The retirement page still carries the oldest version, which opens with an affirmative yes and links an undated memo. The annuity page now carries this fourth wording, and the individual page carries no Mandiant answer at all. The Canadian affiliate's FAQ at trustage.ca continues to state the clean-and-contained conclusion in TruStage's own voice, as it has since August 24.

For a credit union nothing here changes service status, member guidance, or any contact detail. It matters because this is the answer a member, a board or an examiner is most likely to be shown when they ask whether the incident is over, and the strongest version of it has now been pulled off the page that first carried it. Anyone who quoted the annuity page's clean-and-contained sentence since Thursday should check the page again before repeating it. TruStage has not said why the wording changed, and this tracker is not inferring a reason. One method note: unlike the September 11 reversal on the same page, this edit did move the outage family's shared “Last Updated” stamp, which rolled to September 14, 1:33 p.m. Central — five of the six dated pages took that stamp and nothing else.

Update, later on September 14: the page counts above held for about four hours. Between this tracker's 4:01 p.m. and 7:50 p.m. checks TruStage put this same new wording on the wealth management solutions page, which had been the last US outage page carrying the affirmative finding, and on the general business page, which had been on the September 3 wording. Three US outage pages now carry the new wording, the credit union and preplanning pages carry the September 3 wording, retirement carries the oldest version and individual carries no Mandiant answer. See the later September 14 entry.

On September 11 TruStage rewrote the disbursements roll-up on its outage hub and credit union page to say that disbursement capabilities continue to expand across Life. At our 10:01 a.m. Eastern sweep on September 14 the hub had dropped the last two words; the credit union page still carried them, and a re-check two minutes later showed it had taken the same edit. That one line was the only difference on either page — the credit union page was otherwise identical to the previous snapshot.

Removing a line-of-business qualifier widens the sentence back into a general statement about disbursements, but TruStage named no newly restored capability, made no announcement, and did not re-date the block, which still reads “Latest update – Sept. 11.” The two bullets under it — retirement loan and distribution requests and periodic benefit payments, and annuity withdrawal, surrender and lifetime income options — are unchanged word for word.

One reading is worth noting, as our own wording, not TruStage’s: the Life-scoped version was the harder of the two to square with TruStage’s own disbursements dashboard, which marks life one-time withdrawals and surrenders unavailable while showing annuity one-time withdrawals, recurring withdrawals and surrenders available. Dropping the qualifier removes that specific tension without changing anything on the board.

For a credit union this is wording, not restoration. The disbursements dashboard headline still reads unavailable, and the gap between the roll-up sentence and the per-product board that we flagged on September 11 is unchanged. Read the dashboard, not the roll-up, when a specific transaction is at stake.

Mechanical repair coverage has been one of the few lines on TruStage's servicing dashboard marked available since the dashboards went up on August 20. In the September 11 edit its section label and both of its function rows — manage policy or contract, and cancel policy or contract — changed from available to partially available. No other label on that dashboard moved.

TruStage did not explain the change, and it did not edit the sentence under the heading, which still says mechanical repair coverage servicing remains available through Assurant's normal servicing channels. The page therefore now contradicts itself on this product: the prose says available, the labels say partially available. A credit union should treat the label as the more current of the two, since the labels are what TruStage moved.

The downgrade is limited to servicing. On the claims dashboard, mechanical repair coverage claims remain fully available through Assurant's established claims process, with submission, processing and payout all still marked available and the section untouched in this edit. So a member with a repair claim in progress is in the same position as yesterday; a member trying to change or cancel a contract may not be.

The September 11 edit rewrote the policy and contract servicing and disbursements sections of the outage hub, the credit union page and both matching dashboards, replacing general descriptions with named capabilities. On retirement, representatives can now give account balance information, support loans and distributions for eligible plans, and take investment change requests for eligible plans. On annuities, available servicing now includes withdrawal processing, surrender processing, direct deposit servicing, application cancellations and annuity death claim support. Life and AD&D representatives are described as able to answer many policy inquiries, point customers to service forms and continuity processes, and explain servicing options and next steps.

Two limits are stated as plainly as the additions, and both matter to a credit union fielding calls. TruStage says retirement digital access remains unavailable while recovery continues — the first time it has said so in those terms on its own servicing dashboard, after CrossState described restoring digital access as a phased priority on September 9. And employer contribution processing continues to run through interim continuity solutions rather than normal systems. The broader caveat is repeated across all three surfaces: some servicing requests still require interim or manual processes, and certain functions remain limited.

The same rewrite dropped three reassurances from the hub and credit union summary blocks that had been there since September 4 — that outage-period requests would be honored based on their original submission date, that recurring ACH and certain recurring card payments had resumed for eligible life and AD&D customers, and that coverage protections and grace period accommodations remain in place. Two of the three survive in the FAQ accordions further down the credit union page, which still describe the recurring ACH and card restarts by date and still say TruStage is extending applicable grace periods. The submission-date commitment survives there in different words: the FAQ says requests received during the outage will be processed and honored based on the date they were received. Nothing was retracted; the summary block was shortened.

Disbursements moved in the same direction. The September 11 edit replaced the hub’s “some disbursement services are currently available” with “disbursement capabilities continue to expand across Life,” while the disbursements dashboard headline still read unavailable and still showed life one-time withdrawals and surrenders as unavailable. TruStage dropped the “across Life” qualifier on September 14 — see the later item; the divergence with the dashboard is unchanged. Read the per-product dashboard rather than the roll-up when a specific transaction is at stake.

The payment protection section of TruStage's claims dashboard was rewritten in the September 11 edit. It now says additional claim payments have recently been delivered to members, including more than $6.6 million in credit insurance and debt protection life claim payments, and that this accounts for 100 percent of outstanding payments for debt protection life and credit life claims submitted before the outage.

Read the scope narrowly. The completion statement covers two coverages — debt protection life and credit life — and only claims submitted before the July 11 outage. The same section also covers GAP, and GAP is named nowhere in the completion sentence; the dashboard's earlier line saying review of GAP claims filed after July 11 had begun was removed in the same edit and replaced, on the hub, with a general statement about post-July 11 claims review continuing. Nothing here says GAP claims are finished.

This is the first time in the incident that TruStage has described any category of claims as fully paid rather than in progress, and the coverages involved are credit union lending products, so it is directly relevant to a credit union's own members. The availability labels did not move to match: submission, processing and payout for payment protection all remain partially available, which is consistent with post-outage claims still being worked.

Between this tracker's 4:01 p.m. and 6:01 p.m. Eastern checks on September 11, TruStage rewrote the dated update blocks on its outage hub and its credit union outage page, rolling both from September 4 to September 11, and rewrote all three of its status dashboards. The single most consequential edit is a deletion. The sentence saying TruStage expected to complete payment of most life and AD&D claims submitted before July 11, 2026 by mid-September is gone from both pages, and nothing dated replaced it.

The claims dashboard lost its own timing at the same moment. Its life and AD&D sections had carried an undated expectation that most pre-outage claims would be paid “by the end of next week” since the afternoon of August 28, unchanged in body for two weeks after the week it pointed at had passed. Both sections now say instead that claims continue to be reviewed, processed and paid as capabilities are restored. That closes the divergence this tracker had been reporting since September 4, when the two surfaces published different expectations — but it closes it by withdrawing both, not by reconciling them.

What TruStage publishes in their place is a progress total rather than a schedule: more than $44 million in pre-outage life and AD&D claims have been paid, with teams continuing to work through the remainder, including claims that need additional documentation. The figure appears on the hub, the credit union page and both dashboard sections, and it is the first dollar figure TruStage has put on any of its own outage surfaces — until now the only public numbers came from CrossState on September 9 and Credit Union Daily on September 10, and neither used this scope. The hub also replaced its narrower line about GAP claims filed after July 11 with a general statement that review of claims submitted after July 11 continues as capacity expands.

For a credit union the practical effect is that there is now no published date for any claim. A member told in early September to expect payment by mid-September has been given an expectation TruStage no longer stands behind in public. No availability label moved with the change: claims submission, processing and payout remain partially available across every product line on the dashboard.

At this tracker's 2:01 p.m. check on September 11, the answer to “How can I access my annuity contract details?” on trustage.com/outage/annuity closed by directing customers to the Annuity Transaction Capabilities resource and the Annuity Disbursements FAQs for availability by transaction type, and gave two numbers: clients 800-798-5500, advisors 877-345-4769 with Option 2 twice. At the 4:01 p.m. check that closing passage was gone. The answer now ends by saying customers may call 800-798-5500. Everything before it is unchanged, and the Mandiant answer rewritten in the same morning edit was left in place.

Where the withdrawn items stand now. The advisor line 877-345-4769 is back to appearing on one tracked TruStage surface only — the policy and contract servicing status dashboard, which has carried it since August 20 and which nothing on the site links. The 800-798-5500 number survives in three places: this answer, that same dashboard, and the variable universal life FAQ, where it is given as a general assistance and TTY number rather than an annuity line. Neither the Annuity Transaction Capabilities resource nor the Annuity Disbursements FAQs appears on any tracked TruStage page at this check. TruStage has not said whether they were renamed, withdrawn, or published ahead of schedule, and this tracker is not inferring which.

What a credit union should do with it. If anyone routed an annuity question this afternoon using the advisor line or those resource names off the outage page, re-check the page before repeating the referral. The annuity page's standing direction is unchanged and is the safe one: the Annuity Contact Center at 855.591.9027, Monday through Friday, 8:00 a.m. to 5:00 p.m. Central.

Two notes on method, because they affect anyone watching these pages directly. First, the page's “Last Updated” stamp did not move with this reversal — it still reads September 11, 12:20 p.m. Central, the value it took in the morning edit — so the stamp cannot be used to tell whether a TruStage outage page has changed. Second, this tracker's standing-claim check caught the withdrawal on the same run and the earlier entry was corrected rather than left standing; the record of what the page said at 2:01 p.m. is kept in that entry.

Between this tracker's 2:01 p.m. and 4:01 p.m. checks on September 11, TruStage rewrote the containment answer on trustage.com/outage/business/wealth-management-solutions. The question is unchanged and still asks whether a cybersecurity expert has provided information on whether the incident is contained and whether TruStage is operating in a clean and safe environment. The answer had carried the September 3 wording, which reported only what Mandiant did not find. It now leads with the affirmative finding — that on the forensic evidence reviewed to date, Mandiant reported TruStage's operating environment is clean, the incident is contained and it identified no indication of active intrusion — keeps the no-activity sentence below it, and closes by pointing to the August 27 Investigation Memo.

This is the same rewrite the annuity page took about four hours earlier, and it makes the rollout a genuine propagation rather than a one-page experiment. Who is speaking still matters: like the annuity page, this one attributes the conclusion to Mandiant and does not answer yes or no in TruStage's own voice. The Canadian affiliate's FAQ at trustage.ca, which has carried a version of the sentence since August 24, does open with an affirmative yes and states the conclusion in TruStage's voice. A credit union quoting a US page is quoting a report of what TruStage's forensic firm concluded, within a scope Mandiant has not publicly defined.

Three outage pages still carried the September 3 wording at this check — business, credit union and preplanning. The retirement page still carries the oldest version, which opens with an affirmative yes, cites an undated memo and has taken neither rewrite. The individual outage page carries no Mandiant answer at all. Until the rollout finishes, two credit unions reading two TruStage pages will still get materially different answers to the same question.

One verification note for anyone watching these pages directly: this edit did not move the page's “Last Updated” stamp, which still reads September 11, 12:20 p.m. Central — the same value it carried at the 2:01 p.m. check, before the body changed. The stamp is not a reliable signal that a TruStage outage page has been edited. Nothing here changes service status or what to tell a member.

Correction, September 14: TruStage has withdrawn this wording. Between this tracker's 4:01 p.m. and 7:50 p.m. checks on September 14 the wealth management solutions page's answer was rewritten again, and the affirmative clean-and-contained sentence described above no longer appears on it. This page was the last US outage page carrying that sentence, so with this edit the affirmative finding is off every US TruStage outage page. This entry is kept as the record of what the page said between September 11 and September 14; for the current wording and what changed, see the September 14 entry.

The September 11 afternoon edit to trustage.com/outage/business/wealth-management-solutions also extended the answer to “When will this be resolved?” The existing paragraph — phased recovery, a broad portion of the technology environment affected, systems restored carefully, some capabilities needing more time — is unchanged. Appended to it is a new characterization of where recovery stands: that it is increasingly moving “from access to execution,” with more customers and members reaching TruStage, more claims moving through the process and more transactions being completed, and that some services continue to rely on interim or manual processes.

The framing is new to this record. TruStage's recovery language to date has described what has been restored and what has not; this sentence describes a shift in the character of the problem — from whether a customer can get through at all to whether the work behind the call can be finished. The caveat travels in the same sentence, and it is the operative half for a credit union: interim and manual processes are still in use, which is what turnaround times and error rates depend on.

What the sentence does not carry is any number, date or product scope. It names no volumes, no completion target and no service that has moved from one state to the other, so it cannot be used to tell a member that a specific capability is now working. For that, TruStage's service status dashboards remain the concrete reference. The mid-September target for most Life and AD&D claims submitted before July 11, which this item originally named alongside them, was deleted by TruStage later the same day.

At this check the sentence appeared on the wealth management solutions page only; the same answer on the business, credit union, annuity, preplanning and retirement pages still ends at the older wording. As with the Mandiant rewrite carried in the same edit, the page's “Last Updated” stamp did not move.

Update, September 14: the sentence is no longer confined to one page. On the evening of September 14 TruStage appended it, word for word, to the same answer on the general business outage page, which is the first time this characterization has propagated. See the September 14 entry for that edit.

Update, September 15: the credit union and individual pages took the sentence too, putting it on four pages. The annuity, preplanning and retirement answers still end at the older wording. See the September 15 entry.

The September 11 edit that rewrote the Mandiant answer also extended the answer about accessing annuity contract details on trustage.com/outage/annuity. Where the answer had ended by saying online access may stay limited during a controlled recovery, it added a pointer to the Annuity Transaction Capabilities resource and the Annuity Disbursements FAQs for current availability by transaction type, and gave two numbers: clients could call 800-798-5500, and advisors could call 877-345-4769 and select Option 2 twice. This tracker recorded that at its 2:01 p.m. check.

By the 4:01 p.m. check TruStage had reverted the addition. The answer's closing sentence now reads only that customers may call 800-798-5500; the two resource pointers and the advisor line are gone, and the “clients” and “advisors” framing with them. The page's Mandiant answer, rewritten in the same edit, was left in place. The reversal is recorded as its own entry, 2026-09-11-trustage-annuity-contact-answer-pullback.

What a credit union should use today: the annuity outage page still directs customers to the Annuity Contact Center at 855.591.9027, Monday through Friday, 8:00 a.m. to 5:00 p.m. Central, and that line has not moved. The 800-798-5500 number remains inside this FAQ answer and also appears on TruStage's policy and contract servicing status dashboard and in the variable universal life FAQ. The advisor line 877-345-4769 is back to appearing only on that servicing dashboard, which nothing on the site links. Neither number was ever new to TruStage's site; both have been on the dashboard since August 20.

The same edit also relabelled one form on the page, from an application cancellation form to an annuity application cancellation form, and that relabel survived the reversal. This tracker corrected this entry in the run that found the reversal rather than leaving the earlier wording standing.

Between this tracker's 12:01 p.m. and 2:01 p.m. checks on September 11, TruStage rewrote the containment answer on trustage.com/outage/annuity for the second time in nine days. The question is unchanged and still asks whether a cybersecurity expert has provided information on whether the incident is contained and whether TruStage is operating in a clean and safe environment. Since September 2 the answer had reported only what Mandiant did not find — no threat-actor activity within the scope of its investigation since July 11. The answer now leads with an affirmative finding attributed to Mandiant: that on the forensic evidence reviewed to date, TruStage's “operating environment is clean, the incident is contained” and Mandiant has identified no indication of active intrusion. The earlier no-activity sentence is kept below it, and the closing pointer now reads as the August 27 Investigation Memo rather than Mandiant's most recent memo.

This reverses the direction of the September 2 change on the same page. That edit made the annuity page the first US surface to drop an affirmative answer; this one makes it the first US surface to carry the fullest affirmative wording TruStage has published anywhere. Note who is speaking. The Canadian affiliate's FAQ at trustage.ca has carried a version of this sentence since August 24, but there it opens with an affirmative yes and TruStage states the clean-and-contained conclusion in its own voice. The US annuity page attributes the conclusion to Mandiant and does not answer yes or no in TruStage's voice. The distinction matters for anyone quoting the page: this is a report of what TruStage's forensic firm concluded, within a scope Mandiant has not publicly defined, not a company guarantee.

The rollout is partial, as every TruStage wording change in this record has been. At the 2:01 p.m. check four other outage pages — business, credit union, wealth management solutions and preplanning — still carried the September 3 wording with the August 27 memo reference; by the 4:01 p.m. check the wealth management solutions page had taken the new wording, leaving three. The retirement page still carries the oldest version, which opens with an affirmative yes, cites an undated memo, and has never taken either rewrite. The individual outage page carries no Mandiant answer at all. Expect the new wording to spread over the coming days; until it does, two credit unions reading two TruStage pages will get materially different answers to the same question.

The whole outage family re-stamped in this edit, moving to September 11, 12:20 p.m. Central, but only the annuity page's body changed. For a credit union nothing here changes service status or what to tell a member. It matters because this is the answer a member, a board or an examiner is most likely to be pointed at when they ask whether the incident is over, and because it is the first time a US TruStage page has said so affirmatively.

Correction, September 14: TruStage has withdrawn this wording. Between the 2:01 p.m. and 4:01 p.m. checks on September 14 the annuity page's answer was rewritten a third time, and the affirmative clean-and-contained sentence described above no longer appears on it. The page now reports only that Mandiant found no evidence of threat-actor activity in the affected environments since July 11. This entry is kept as the record of what the page said between September 11 and September 14; for the current wording and what changed, see the September 14 entry.

TruStage rewrote the payment answer in the FAQ on trustage.com/outage/individual in the same September 10, 3:38 p.m. Central edit that added Saturday phone hours. The previous answer said only that payment processing was limited and that customers could pay once operations were restored. The new answer says online one-time payments are unavailable, that TruStage is unable to mail a bill or provide a total past-due balance, that customers will not lose coverage because they could not pay during the disruption, and — this is the new capability — that a payment may be submitted by mail with the policy or certificate number written on the check or money order.

The addresses live on a new sub-page, trustage.com/outage/individual/payments, stamped September 10 and linked only from that rewritten answer. It gives four lockboxes, all in the name of CMFG Life Insurance Company: PO Box 4651, Carol Stream, IL 60197-4651 for accidental death and dismemberment; PO Box 4652, Carol Stream, IL 60197-4652 for AD&D coverage written through New Jersey credit unions; PO Box 4650, Carol Stream, IL 60197-4650 for life and health; and 2000 Heritage Way, Waverly, IA 50677 for annuity and variable universal life. The page also shows sample policy-number formats so a customer can find the right number, and links a “Locate your number” helper. This tracker has added the page to the set it sweeps every cycle.

Two things to keep straight when you brief staff. The phone number printed on the new page, 1-833-374-1541, is TruStage's general sales line for licensed agents, not an outage contact — the outage line for individual policyholders was 855-591-9026 at the time of this entry, and is 1-800-779-5433 since TruStage swapped it on September 15. And the mail channel is a workaround, not restored billing: TruStage still cannot tell a member what they owe, so a member who mails a payment is estimating. The grace-period protection is the safety net TruStage points to, and it continues to say more than one premium may come due once the extended grace period ends.

The rewritten answer appears on the individual outage page only. As of this check no other tracked TruStage surface carries the mail-payment wording or links the new addresses page, so treat it as the start of a rollout rather than a company-wide change, and expect the wording to appear on other product pages over the coming days.

Between this tracker's 4:01 p.m. and 6:01 p.m. Eastern checks on September 10, TruStage rewrote the “We're here for you” paragraph on trustage.com/outage/individual and re-stamped the page September 10, 3:38 p.m. Central. The contact sentence, which since September 2 had read weekdays only, now adds Saturday, 9:00 a.m. to 1:00 p.m. Central. The number itself did not move: it is still 855-591-9026, and the rest of the paragraph — that representatives have very limited access to account information and cannot process transactions or submit requests, and that call times may be longer than usual — is unchanged.

This closes a gap this tracker flagged twice. TruStage removed Saturday hours of 9:00 a.m. to 4:00 p.m. Central from this page on September 2 when it swapped 844-958-8910 for 855-591-9026. CrossState published a narrowed Saturday window of 9:00 a.m. to 1:00 p.m. Central on September 9 and CU Daily carried the same window on September 10, but neither could be corroborated against a TruStage surface, so our member page deliberately published no Saturday hours at all. TruStage's own page now states the narrowed window, and our guidance is updated to match.

Two cautions for credit unions. The Saturday hours are published on the individual outage page only — the annuity, retirement, preneed, business, wealth-management and credit-union outage pages carry no Saturday hours, and the annuity contact center at 855-591-9027 is still listed weekdays only. And TruStage announced none of this: no newsroom release accompanied the edit, and the page's stamp is the only public marker that it changed.

Between this tracker's 2:01 p.m. and 4:00 p.m. checks on September 9, TruStage added a new question to the credit-union section of its outage site — “Will TruStage be notifying our members about the incident directly?” — and moved the shared outage-family stamp to September 9, 1:03 p.m. CT. The answer says the investigation is still running, supported by Mandiant and Epiq Global, and that if TruStage determines member, employee, or other affected data has been impacted, credit unions will hear that information from TruStage first, with the stated intent of giving them time to partner on any communication that follows. TruStage repeats that it will support credit unions through notification and reporting requirements.

The notification commitment itself is not new — TruStage has said since July that it would work through credit unions before contacting their members, and this tracker has carried that as a confirmed fact. What is new is where it now sits: a plainly worded question on the credit-union page, rather than a clause inside a longer investigation answer. Epiq Global is the more substantive addition. TruStage named the firm in its August 12 partner update, and trade press and a peer association reported it the same week, but no TruStage-owned public page had carried the name until today. This is the first, and it puts the two-vendor structure of the data review — Mandiant on the forensics, Epiq on the data analysis — on an official surface credit unions can cite.

Read the answer for what it does not say. It states no date, gives no notification timetable, and does not say that any data was affected; TruStage's position that it does not yet know remains unchanged across every page checked. One other edit landed in the same pass: the GAP and MRC question was retitled from whether waivers and certificates “issued during the outage” will be honored to whether those “sold during the outage” will be, and its answer picked up the sentence about TruStage developing processes to capture workaround data and issue member contracts. That sentence has been elsewhere on the same page since late August, so this is consolidation rather than new guidance. The other five dated outage pages took only the stamp line.

Between this tracker's 2:01 p.m. and 4:00 p.m. checks on September 8, TruStage rewrote the headings on its annuity outage page so that variable universal life is named throughout. The page title went from “Annuity” to “Annuity forms and resources,” and the section and form headings were rescoped: owner resources, withdrawal and surrender requests, general resources, allocation change and transfer forms, and the downloadable partial withdrawal and surrender forms are now all labelled “Annuity and VUL.” Variable universal life is named eight times on the page; before this edit it appeared once, on the VULI and VULII allocation change form TruStage added there on September 2.

No form was added or removed and no wording below the headings changed. The AssureSign electronic partial withdrawal and surrender forms, the mailed PDF versions, the death benefit and RMD forms, and the annuity contact center details — 855.591.9027, Monday through Friday, 8:00 a.m. to 5:00 p.m. CT — are all as they were. TruStage's “Last Updated” stamp did not move; it still reads September 8, 7:38 a.m. CT, so the company's own published date does not reflect this edit, the same undated pattern recorded when the direct deposit form was added on August 19 and the VUL allocation form on September 2.

Worth knowing if you field member calls: TruStage's own variable universal life product FAQ, at trustage.com/my-account/help/variable-universal-life-faqs, has not been changed to match. It tells VUL owners that partial withdrawals cannot be made online at this time and to call customer care, and that allocation changes and fund transfers must be made by printing and mailing a Service Request form or by phone. The outage page now offers those same owners an electronic partial withdrawal form through AssureSign. The two pages also carry different contact details: the FAQ's contact block gives 1-855-591-9026, weekdays 7:00 a.m. to 6:00 p.m. CT, and directs document requests to 1-800-798-5500, while the annuity outage page gives 855.591.9027 and shorter hours.

TruStage has not said which route it wants VUL owners to use, and this tracker is not in a position to say either — both pages are TruStage's own. Members asking about a VUL withdrawal or allocation change are best pointed at the annuity outage page, which is the surface TruStage keeps current during the outage, with the caveat that the product FAQ still says something different. As with the other forms published during the outage, these are workarounds rather than restored processing; the page still tells customers they may have difficulty accessing account information, completing transactions or submitting requests online.

Between this tracker’s 2:01 p.m. and 4:00 p.m. checks on September 4, TruStage substantially rewrote its retirement outage page and moved the shared outage-family stamp to September 4, 2:09 p.m. CT. The page now describes a temporary process that lets participants change investment elections, request transfers, and rebalance their investments. TruStage limits it to defined contribution plans — 401(k) and 403(b) — together with governmental and tax-exempt 457(b) plans recordkept on Matrix, meaning plans that do not use its Choice Group Variable Annuity, and says the capability reaches most but not all of those. Participants are told to confirm eligibility with the Participant Service Center at participantservicecenter@benefitsforyou.com, then to request a plan-specific form carrying fund fact sheets and prospectuses from a TruStage Education Services Center at educationsolutions@trustage.com. Existing elections stand unless a participant submits a request.

This is the first route back to investment transactions TruStage has publicly described for retirement participants. Until today the page said only that interim processes let some participants call for balances and forms; the answer that had listed investment election changes and trade requests among the unavailable functions was removed on August 18 without TruStage saying those functions had returned. Read the limit as carefully as the capability. Participants in Choice Group Variable Annuity plans get nothing here, and TruStage says separately that it still cannot accept payroll files for those plans at all, though it will hold their deposits in a non-interest-bearing account until the money can be allocated to participant accounts.

The plan sponsor section was rebuilt around plan type. For Matrix-recordkept plans, files arriving through an automated payroll-provider or aggregator integration keep processing, and TruStage says its payroll team will make contact when a file arrives not in good order or needs funding approval. Employers who normally upload files themselves, or whose providers use MoveIt or another non-automated route, were emailed an interim process on August 19 for uploading through a TruStage secure portal. Sponsors are told to keep using their pre-outage templates for payroll funding and loan payoff files, to keep enrolling newly eligible employees under the terms of the plan document, and — for every plan type — that contributions are being processed as of the payroll check date, so pricing matches the date the money should have gone into the market. TruStage also links, for the first time on its own site, a white paper from its outside counsel Groom Law on the Department of Labor guidance behind its position that employers have additional time to submit payroll files when a service-provider outage causes the delay. That link, trustage.com/ProcessingDelayWhitePaper (PDF, downloads to your device), downloads a PDF rather than opening a page. A peer association reported the paper existed on August 8; TruStage had not published it publicly until now.

Two smaller edits are worth flagging. The statement answer now says quarterly participant statements are mailing on the normal schedule for most plans, and that statements for Choice Group Variable Annuity plans may be delayed — a qualification the earlier wording did not carry, and which replaced the week of August 10 mailing date previously given for participants who had elected electronic delivery. Separately, the answer on whether accounts were affected was cut to a single sentence saying participant assets remain safe and invested; the withdrawal, loan and balance-by-phone detail it used to carry still appears elsewhere on the same page, so that is a consolidation and not a withdrawal of the capability. None of this reached any other TruStage surface at this check — the other five dated outage pages took only the stamp line — and the retirement page remains the only outage page still carrying the older Mandiant answer and the August 10 memo link, which survived today’s rewrite untouched.

Withdrawn September 11. TruStage removed this expectation from both pages that carried it in its September 11 rewrite, and set no new date; see the September 11 item on the withdrawal. What follows is the record of what those pages said for the week it stood.

At this tracker's 6:01 p.m. check on September 4, the outage hub at trustage.com/outage and the credit union outage page had both gained dated “Latest update — Sept. 4” blocks under all three service categories: claims, policy and contract servicing, and disbursements. Neither page has carried per-category dated updates before, and no other tracked TruStage surface carries this text.

The headline is the timing. TruStage says it expects to complete payment of most life and AD&D claims submitted before July 11, 2026, “by mid-September.” That is the first time it has restated the claims-payment expectation since its claims dashboard published one on the afternoon of August 28, and it moves the target: read on August 28, the dashboard's undated “end of next week” pointed at the week beginning August 31, which ends today. Credit unions that told members to expect payment this week should expect it to run about another week and a half.

The dashboard itself was not changed. At the same check the claims dashboard still read “by the end of next week,” unchanged in body for the sixty-fifth consecutive snapshot since August 28 — so TruStage is now publishing two different expectations in two places, and the dashboard's carries no date stamp to date it by. Read the hub or the credit union page for the current one.

The other blocks restate and narrow ground already covered. On servicing, TruStage says representatives can answer basic policy questions, explain servicing options, guide callers on forms and continuity processes, and escalate concerns; that requests submitted during the outage will still be honored based on their original submission date, which it had not said before; that recurring ACH and certain recurring credit card payments have resumed for eligible life and AD&D customers using payment details already on file; and that coverage protections and grace period accommodations remain in place. On disbursements it says some services are now available and points life, annuity, retirement and executive benefits account holders to its disbursements page — while the disbursements dashboard's own headline still reads unavailable. No availability label moved with any of this: all nine functions across the three categories remain marked partially available.

Between this tracker’s 12:02 p.m. and 2:01 p.m. checks on September 3, TruStage replaced the cybersecurity-expert FAQ answer on three more outage pages — business, wealth management solutions, and preplanning — with the wording its annuity page took on September 2. The question is unchanged and still asks whether an expert has provided information on whether the incident is contained and whether TruStage is operating in a clean and safe environment as systems return to service. All four pages now answer that Mandiant has not identified any threat actor activity within the environments in the scope of its investigation since July 11, 2026, which TruStage describes as the date it first became aware of the incident and took measures to contain and remediate it. Unlike the September 2 edit, TruStage moved its “Last Updated” stamp with this one: the six dated outage pages now read September 3, 11:26 a.m. CT.

The second change is the document itself. All four rewritten pages now describe the linked file as Mandiant’s most recent investigation memo dated August 27 — a newer memo than the August 10 one TruStage published on its own site and this tracker has linked since August 11. The link target moved with the wording: the business and annuity pages point to trustage.com/mandiant-investigation-memo, an undated address that resolves to a different stored file than the dated August 10 address, which is still live. The two pages that kept the earlier answer — credit union and retirement — still link the August 10 memo, so at this check TruStage was publishing both memos at once, with which one a reader gets depending on the page they start from.

Read this narrowly. The August 27 date is TruStage’s description of the document; this tracker links what TruStage links but did not read the memo itself, and Mandiant confines its findings to the environments within its investigation’s scope, which it has not publicly defined. Nothing here is a finding about whether data was accessed, which TruStage still says requires extensive investigation. No availability label moved with the change and every outage page still shows status Investigating, so it is not a restoration announcement. The practical effect for a credit union is narrower and concrete: the memo you may have filed on August 11 is no longer the one TruStage points to.

One mechanic is worth noting for vendor-management files. The earlier memo had a dated short URL and a dated filename; the replacement has neither, so a future revision could appear at the same address without the link changing. The date TruStage prints in the outage-page sentence is the only version marker it publishes, which is what this tracker now watches. The Resources list on this page has been repointed to the newer memo.

At this tracker’s 4:02 p.m. check on September 3, TruStage’s outage page for individuals had gained three new questions under a new policy-servicing topic. TruStage says a policyholder who needs a change such as an address or beneficiary update, or who wants to cancel, should follow the instructions on the applicable form on its individual service-forms page, and that for many customer-service transactions the form has to be submitted by mail. It gives its reason: mail keeps forms and supporting documentation inside a controlled process carrying the customer authorization it needs, and helps it meet security, privacy, and record-retention requirements while recovery continues. First notice of loss can still be filed online at trustage.com/startclaim, which TruStage says routes to its claims team.

The second new answer is the one worth passing to members. TruStage says it has reviewed alternative channels including email, fax, and online upload, but that sensitive payment information and other restricted consumer information mean the appropriate security, privacy, authentication, and retention controls have to be in place and approved before any of them can be used. It says teams continue to evaluate whether more channels can be opened, and names no date. For certain products it says limited phone-based transaction support may be available and tells customers to ask the service team for their product what it can currently do.

Practical effect for a credit union fielding member questions: mail remains the route for individual life and AD&D policy servicing, and TruStage has not announced a digital alternative. This does not change annuity servicing, where TruStage has separately accepted e-signed forms, or claims intake, which stays online.

TruStage did not move this page’s “Last Updated” stamp with the edit — it still read September 3, 11:26 a.m. CT, the time of a separate change made that morning. The three answers were on the individual page only; no other tracked TruStage surface carried them at this check, and none had carried them in any earlier snapshot. The page also took the topic-browse FAQ layout the credit-union outage page was already using, and TruStage fixed two typographical errors in its billing answers at the same time.

Between this tracker's 4:02 p.m. and 6:42 p.m. checks on September 3, TruStage made three changes at once to trustage.com/outage/business/credit-union — the page it directs credit unions and their staff to.

First, the page took the rewritten containment answer this tracker recorded at 2:01 p.m. on the business, wealth management solutions, and preplanning pages. It now says Mandiant has not identified any threat actor activity within the environments in the scope of its investigation since July 11, 2026, and points to Mandiant's most recent investigation memo dated August 27. The link moved with the wording, from the dated August 10 address to the undated one. That brings the rewrite to five of the six US outage pages; the retirement page alone still carries the earlier answer and still links the August 10 memo, which remains live at its own address. Both memos are therefore still published, and which one a credit union reaches now depends on whether it starts from the retirement page.

Second, the three policy-servicing answers TruStage added to its individual outage page two hours earlier appeared here as well: that many customer-service transactions require the form to be mailed, why mail is required, and that email, fax, and online upload have been reviewed but not approved pending security, privacy, authentication, and retention controls. No date is given for any of them. This is the first time that guidance has reached a credit-union-facing surface, and it is the answer to give a member asking how to change a beneficiary or cancel a policy today.

Third, TruStage removed the CEO video and its transcript from the page. The transcript had been present in every snapshot of this page since July 29 — 233 consecutive checks — and is now absent both from the extracted text and from the page's own markup, which no longer carries a video embed. That video was the last place on any live TruStage page where the withdrawn mid-August recovery target still appeared; it now survives only in the July 31 and August 13 newsroom releases, which remain posted as dated records. TruStage did not announce the removal, did not move the page's "Last Updated" stamp with the edit, and published nothing in the video's place. It also corrected the wording of its August 20 credit-card-draft sentence at the same time, without changing what it says.

TruStage's life insurance side reached the SEC record on September 2 for the first time in this tracker. Every earlier filing logged here came from an annuity registrant; this supplement was filed by the CMFG Variable Life Insurance Account (CIK 0000732726), a fourth TruStage registrant, and covers three life products — MEMBERS Variable Universal Life I, MEMBERS Variable Universal Life II and Ultra Vers-All Life. It was filed twice the same day, once by the account and once by its filing agent; the two documents carry the same text.

The supplement names eight transaction types that interim processes now support for these policies: payment of additional planned premium, payment of subsequent premium, partial withdrawals, surrenders, transfers among allocation options, changes to allocation instructions, death benefit claims, and Section 1035 exchanges into a policy at another insurer. It says TruStage is still building interim processes for other financial transactions and gives two examples that therefore are not available — loan processing and dollar cost averaging. Financial requests such as withdrawals and surrenders are being worked first; non-financial requests such as a change of owner or an assignment are described as processed when administratively possible.

Two protections matter to any credit union fielding a call about a lapsed policy. TruStage says the event has not affected policy values or benefits, and that a policy will not lapse or enter a grace period because a premium could not be paid during the disruption; policies already active or already in a grace period stay in that status until normal premium processing resumes, with extended grace periods as processing comes back. If a policy is in a grace period now, TruStage says it will write to the owner with the premium amount and the date it must be paid to avoid lapsing.

For contact, the supplement gives 800.798.5500 and states hours of 8:00 a.m. to 5:00 p.m. CST, adding that the hours may change as restoration progresses. That is the same number TruStage's policy servicing dashboard publishes as its annuity contact center, so the line is now documented as serving variable universal life owners too; no tracked TruStage outage page states hours for it, which makes this filing the only source here for them. The supplement also sends VUL owners to trustage.com/outage/annuity for forms rather than to the life service-forms page — which explains the VUL allocation form that appeared on the annuity page the same day — and repeats that paper forms may be mailed to Waverly, Iowa, and that requests are date- and time-stamped on receipt.

Two limits on what this filing shows. It is not a data finding: TruStage says it is still investigating the scope and impact of the event and makes no statement about whether information was accessed. And it is not this registrant's first outage disclosure — the same account filed a July 21 supplement for MEMBERS Variable Universal Life I that this tracker had not recorded, describing a far longer list of suspended transactions and interim processes limited to mailed withdrawal and surrender requests. That July filing dates the proactive shutdown to July 10, matching the annuity supplement already cited on this page and not the July 11 identification date on TruStage's outage pages; the difference remains unresolved by anything published.

Credit Union Daily published its account of the same TruStage update to credit union partners on September 2 at 5:09 a.m., under Frank Diekmann's byline. It corroborates what CU Today reported the previous day: the Claims Contact Center is open again on 800-356-2644, weekdays 8 a.m. to 5 p.m. Central, covering life, accidental death and dismemberment, lending and business protection products plus certain annuity first-notice-of-loss support. That corroboration matters because the reopening still appears on none of the twenty-five TruStage surfaces this tracker sweeps.

The report adds material neither earlier record carried. TruStage has resumed recurring automated clearing house payments and certain recurring credit card payments for eligible life and AD&D customers, using payment details already on file. One-time payments by telephone remain unavailable, and some customers who normally get paper billing statements may not receive new ones yet. Servicing representatives can now answer basic policy questions, point members to service forms, explain servicing options and escalate complaints, but may still be unable to confirm the status of an individual transaction or request. TruStage also says requests submitted during the outage will be honored based on the date they were originally received.

One detail should be read with care. Credit Union Daily attributes the guidance to an "Aug. 1 update" to credit union partners, while CU Today dated the same communication September 1. Our record does not resolve which is right, and the question is not academic: the recurring statement that most pre-outage life and AD&D claims are expected to be paid by the end of next week means a different week depending on when it was issued. TruStage's own claims dashboard has carried that sentence unchanged since August 28, and it was byte for byte identical again in this evening's sweep, so this tracker keeps its existing note anchored to August 28.

The rest of the report restates limitations already published on TruStage's pages: no timeline for an individual claim, manual or offline handling for policy, beneficiary and ownership changes, cancellations and some disbursements, and longer processing times. It carries one direct acknowledgment from the company, that recovery has not been "a seamless experience" for credit unions, their employees or their members.

Between our 8:01 a.m. and 10:01 a.m. Eastern sweeps, TruStage rewrote the “We’re here for you” paragraph on trustage.com/outage/individual and re-stamped the page September 2, 7:26 a.m. CT. The number members are told to call is now 855-591-9026, replacing 844-958-8910. The change is not cosmetic: 844-958-8910 no longer appears anywhere in the page’s HTML, the visible body copy carries the new number, and its dial link matches it (tel:18555919026, plus four tel:1-855-591-9026 links in the page’s call widget). Published hours narrowed at the same time, from weekdays 8:00 a.m.–5:00 p.m. CT plus Saturday 9:00 a.m.–4:00 p.m. CT to weekdays only, now labelled “our current hours.”

The rewritten paragraph also softens what TruStage tells individual policyholders. It now says some call centers have opened with limited hours, and downgrades the long-standing line that representatives “cannot access” policy or account information to “very limited access”; they still cannot process transactions or submit requests. The sentence is new wording — it appears in none of the 4,472 snapshots this tracker has taken since July 20 — and it is the first general statement on an outage page that call centers have opened, as opposed to the product-specific notices already standing (the annuity outage page has said its contact center is open since August 18, and the August 13 release said the retirement call center was open). It does not name the Claims Contact Center or the 800-356-2644 number that CU Today reported on September 1 and CrossState relayed on September 2, so that specific reopening is still uncorroborated on TruStage’s own site.

Two cautions for credit unions. First, the new number is one digit from the annuity contact center’s: 855-591-9026 is the individual line, 855-591-9027 the annuity line, which is unchanged on the annuity outage page. Second, the swap is partial and unannounced — TruStage published no release, the other outage pages took only their routine stamp roll, 844-958-8910 still sits in the call widget on the retirement outage page, and CrossState was still telling members to call it at our 10 a.m. check. We cannot test whether the old number still answers and TruStage has not said; treat 855-591-9026 as the number TruStage now publishes for individual policyholders, not as proof the old one is dead.

One ambiguity is unresolved and predates the change. The same page prints 855-591-9026 twice more in a sales block advertising licensed agents at weekdays 7 a.m.–9 p.m. CT and Saturday 8 a.m.–4 p.m. CT — a second, wider set of hours on the same number. The number itself is not new to TruStage: it has been on the individual service-forms page since August 28 and is the number in the site-wide contact block. Verified against the live page rather than a search summary; one search summary this slot asserted a third hours set for it, weekdays 7 a.m. to 6 p.m. CT, which we could not find on the page and did not record.

Between this tracker's 2:42 p.m. and 4:01 p.m. checks on September 2, TruStage added a single line to the general resources block of its annuity outage page: a downloadable allocation change form for VULI and VULII policies. It joins the allocation and transfer forms already offered there for ZoneChoice, Zone Income Annuity, Zone Annuity, Horizon and Horizon II Variable Annuity, and Variable Annuity contracts. The page labels it as a PDF and opens it in a new window. This is the first VULI or VULII form to appear on any TruStage page this tracker monitors.

Nothing else on the page changed. The “Last Updated” stamp still reads September 2, 7:26 a.m. CT, so TruStage's own published date does not reflect the edit — the same pattern recorded when the direct deposit form was added on August 19. The annuity contact center details are unchanged: 855.591.9027, Monday through Friday, 8:00 a.m. to 5:00 p.m. CT.

Worth knowing if you field member calls: the form is on the annuity outage page, not on the individual life and AD&D service-forms page, where TruStage otherwise files life policy service forms by policy-number prefix. Anyone searching that page for it will not find it.

As with the other forms published during the outage, this is a workaround rather than restored processing. The annuity page still tells customers they may have difficulty accessing account information, completing transactions or submitting requests online, and TruStage has not said requests submitted on these forms will be handled any faster than its recovery timetable allows.

Between this tracker’s 4:01 p.m. and 6:01 p.m. checks on September 2, TruStage replaced the answer to one FAQ on its annuity outage page. The question is unchanged and still asks whether a cybersecurity expert has provided information on (1) whether the incident is contained and (2) whether TruStage is operating in a clean and safe environment as systems return to service. The answer had read that TruStage continues to work closely with Mandiant as part of its ongoing investigation and recovery efforts, opening with “Yes.” It now says Mandiant “has not identified any threat actor activity within the environments in the scope” of its investigation since July 11, 2026, which TruStage describes as the date it first became aware of the incident and took measures to contain and remediate it. The link to Mandiant’s most recent investigation memo was unchanged at this check; TruStage repointed it to a newer memo on September 3.

What changed is which claim this page makes in its own voice. The words “clean” and “contained” now appear on the annuity page only inside the question; the answer no longer uses either, and no longer starts with an affirmative. Read that narrowly. TruStage has not withdrawn anything: its July 31 and August 13 newsroom releases still state that the incident is contained and that it built a clean, isolated environment, and on September 2 the same containment answer this page dropped was still published word for word on five other outage pages — credit union, business, wealth management solutions, preplanning, and retirement. Three of those five took the rewrite on September 3; see that day’s entry. What this page now offers is a narrower report of what Mandiant did not find, inside a scope Mandiant has not publicly defined.

The sentence itself is not new to TruStage. Its Canadian affiliate’s FAQ at trustage.ca has carried it since August 24, where it was added alongside the fuller “clean, contained, no indication of active intrusion” wording rather than in place of it. The annuity page is the first US surface to take the sentence, and the first anywhere to use it as a replacement.

Verified on the live page rather than from the snapshot alone. TruStage’s “Last Updated” stamp on the page did not move — it still reads September 2, 7:26 a.m. CT — so the edit is not visible from the page’s own date. This is the second silent change to this page today; the VULI and VULII allocation form arrived the same way this afternoon. For a credit union, nothing here changes service status or what to tell a member; it matters because it is the answer a member or an examiner is most likely to be pointed at when they ask whether the incident is over.

CU Today reported on September 1 at 1:21 p.m. that TruStage has reopened its Claims Contact Center, citing an update the company sent to credit union partners the same day. According to that report, credit unions and members can call 800-356-2644 to report a claim, supply documentation, confirm that a claim filed after the outage was received, and get guidance, and the center is handling life, accidental death and dismemberment, lending, business protection and certain annuity claims. The report adds that TruStage has begun reviewing GAP claims filed after July 11, that credit insurance, debt protection and GAP claims continue to be accepted and processed, and that anyone who has already filed should not send a duplicate.

Two things in the report are not on any TruStage page this tracker follows. The first is the reopening itself: the phrase Claims Contact Center appears on none of the twenty-five surfaces swept at 2:01 p.m. Eastern, and the claims dashboard was byte for byte identical to the noon sweep. The number is public — 1-800-356-2644 sits at the foot of all three service dashboards — but it is published there as TruStage's general call line, with nothing identifying it as a reopened claims center. The second is a town hall: CU Today says President and CEO Terrance Williams will hold one for credit union partners in the coming weeks, and that the September 1 communication set no date. The report also describes a caution to credit unions that TruStage is not recommending replacement policies from other insurers, which likewise appears on no tracked page.

One point needs care. The report restates that most life and AD&D claims pending before the July 11 attack are expected to be paid by the end of next week. That is word for word what TruStage's own claims dashboard has said, unchanged, since August 28, so the report does not by itself settle which week is meant: read against the August 28 page it is the week beginning August 31, read as a fresh September 1 statement it would be the week beginning September 7. Nothing on TruStage's public pages has moved, so this record keeps its existing note anchored to August 28 until TruStage's own wording changes. The report also carries forward two caveats unchanged — TruStage still cannot give a timeline for an individual claim, and policy, beneficiary and ownership changes, cancellations and some disbursements still need manual or offline handling.

The remainder of the report matches material already published on TruStage's outage pages: recurring ACH and certain recurring card payments resuming for eligible life and AD&D customers on payment details already on file, coverage not being ended over payments missed during the disruption, one-time telephone payments and some paper billing still unavailable, and the standing warning that TruStage is not sending delinquency notices or asking for payment through unsolicited messages. The September 1 partner update itself is not public, so everything above rests on CU Today's account of it.

TruStage rewrote the compensation section of its wealth management solutions outage page between our 12:01 p.m. and 2:01 p.m. Eastern sweeps on August 31. The page's shared last-updated stamp did not move with the edit — it still reads August 31 at 7:50 a.m. CT from this morning's routine roll across the outage family — so nothing on the page signals that its content changed this afternoon. That is the same pattern seen on several earlier edits to these pages.

Three questions came off: how compensation to advisors and credit unions was calculated for the first half of July, for the second half of July, and for the first half of August. One replaced them, asking whether compensation has been paid during the outage. The answer says TruStage Wealth Management Solutions paid managed advisors and dual credit unions as regularly scheduled for all of July and August, and that estimates paid for July were recouped with the actuals in August.

Two things in that are new. The page previously covered only through the first half of August; it now states that compensation was paid as scheduled for the whole of both months. And the true-up is now reported as done rather than planned: the removed answer had said the July estimates would be reversed in August and offset against actual calculations, in the future tense, while the new one says in the past tense that the recoupment happened. For a dual credit union this is a payment it receives, so the completion is worth noting.

One detail was lost in the consolidation. The removed answers described how the estimates were calculated — an average of the last six pay periods for managed advisors, and for dual advisors the same average paid to the credit union. That description is no longer on the page, so a credit union reconciling an August remittance against a July estimate will not find the method there and should ask its account representative, which is what the page's closing line already directs readers to do. Nothing else on the page changed.

TruStage restructured the front of its outage hub between our 12:01 p.m. and 2:01 p.m. Eastern sweeps on August 31. The hub carries no last-updated stamp, so a snapshot comparison is the only way to date the change. The headline changed from a line saying TruStage was actively investigating a cybersecurity attack to one describing recovery status and online resources. The paragraph beneath it is unchanged, still dating the attack to July 11 and describing infrastructure being rebuilt rather than simply switched back on.

The substance of the change is a new block headed recovery status updates. It groups eleven functions under three headings: claims (submission, processing and payout), policy and contract servicing (one-time payments, recurring payments, managing a policy or contract, and cancelling one), and disbursements (one-time withdrawals, recurring withdrawals and surrenders). Every one of the eleven is marked partially available. Each group ends with a link to the matching dashboard at trustage.com/outage/claims-status, /policy-servicing-status and /disbursements-status. Those three dashboards have been published since August 20, but until now nothing on the hub pointed to them; the credit-union outage page was the only tracked surface that did, which meant a member arriving at the hub had no route to them.

One thing to read carefully: the summary is more favorable than the dashboard it links. The disbursements dashboard still carries unavailable as its own overall label, and for life coverage it lists one-time withdrawals and surrenders as unavailable, while the hub rolls all three disbursement functions up as partially available. The roll-up appears to be an across-products summary and should not be read as the status of any particular product. For a specific coverage, open the dashboard and read the product row and the note under it.

The resource links below the new block were re-marked-up as buttons rather than spelled out in sentences. That makes the reference to Mandiant's investigation memo look in a text comparison as though it were removed; it was not — the link is still in the page source and still points to trustage.com/mandiant-investigation-memo-081026. Worth noting for anyone following the hub: the button now labelled newsroom updates does not open a newsroom index but goes straight to TruStage's August 13 press release. All of this was confirmed against the live page after the sweep.

TruStage rewrote two answers on its consumer service-disruption FAQ and moved the page's status stamp to August 31 at 11:15 a.m. CT. The edit landed between our 12:01 p.m. and 2:01 p.m. Eastern sweeps. The outage-information page shares that stamp and carries the timestamp change alone.

The first rewrite closes a rollout this record has followed since August 26. The consumer FAQ now carries, word for word, the same data-investigation answer as all seven outage sub-pages: TruStage continues a comprehensive forensic and data-impact analysis with outside cybersecurity experts, establishing whether any information was accessed and how far any impact reaches requires extensive investigation and validation, the analysis is “expected to take additional time,” and if TruStage determines notifications are required they will be made through the appropriate channels. What went is the earlier framing — that it would be premature to draw conclusions about the scope or impact of the incident, and that the company did not want to speculate or get ahead of the facts. Since mid-August this page had kept that wording and appended the forensic paragraph beneath it; now the older text is gone. No finding about data has been reported either way.

The claims answer was reworked as well, from a single block into five short paragraphs. Most of the substance carries over: product-specific claim payment timelines are still not available, preplanning and funeral claims, GAP claims and debt protection and credit insurance benefits are named as areas where payment has restarted, and life and AD&D processing capabilities are still being restored with claims pending at the time of the outage taking priority over those received after it. Two things did move. The description of payment shifted from having begun paying claims to having resumed claim payment activities, and a new closing sentence says that as additional capabilities are restored TruStage will keep expanding claim payment activities and working through existing claims. No product, service or date is newly named as restored.

With this edit the earlier premature-and-speculate wording survives on one tracked surface: TruStage Life of Canada's service-disruption FAQ at trustage.ca, which still keeps it and appends the forensic paragraph. A separate one-sentence fragment of that older phrasing remains on the wealth management page, but it sits inside a different answer — about credit unions' own notification obligations — not the data-access answer. Both rewrites were confirmed against the live page after the sweep, where the older wording now returns no hits.

CU Today reported on August 29, under Ray Birch's byline, that TruStage has told credit union partners the attack identified July 11 reached its backup systems as well as the primary systems those backups exist to restore. President and CEO Terrance Williams is reported as saying the company must move faster on modernization and build alternate recovery paths, rebuilding capabilities on cloud technology, and as describing a need for "additional layers of resilience and independence" in how critical systems are protected and recovered.

The same report names Kirsten Garen interim chief information officer, leading the recovery and the company's resiliency work. Pat Lawicki, chief information officer since 2024, is reported to be staying on as a consultant. On the investigation side, PwC's cybersecurity team is reported to have joined Mandiant and Epiq Global, the two firms already named in this record, in supporting recovery and the data review.

Why it matters to a credit union: a backup estate caught in the same attack is the difference between restoring from a copy and rebuilding from scratch, and rebuilding is what TruStage has said it is doing. It offers context for a recovery now in its eighth week, and the added investigative capacity is consistent with a data review TruStage has said could take two to three more months, with credit unions notified first if data was affected — both points already recorded here from earlier reporting, as is the CEO town hall for credit union partners that TruStage has said it will hold without setting a date.

Verification notes. The August 29 byline date was read from the article itself, not from a listing. Everything above rests on CU Today's account of TruStage communications to credit union partners that are not public: none of the twenty-five surfaces this tracker sweeps carried the words Garen, Lawicki, PwC or backup at the September 4 noon check, so no tracked TruStage page corroborates the report. The article also described a detailed progress report the chief administrative officer had scheduled for Monday, August 31; this record does not treat that as having occurred.

Removed September 11. The sentence below was never re-dated or restated; TruStage deleted it from the claims dashboard in its September 11 rewrite, replacing it with a dollar total and no date. What follows is the record of what the dashboard said for the two weeks it stood.

TruStage rewrote three product rows on its claims restoration dashboard on the afternoon of August 28; the snapshot pair places the edit between our 4:01 p.m. and 6:01 p.m. Eastern sweeps. Each rewritten row now carries a blue “New” badge — the first time any row on any of the three dashboards has been marked that way since TruStage published them on August 20. The page carries no “Last Updated” stamp, so those badges and a snapshot comparison are the only way to date the change.

The life row now says most pre-outage life claims are expected to be paid by the end of next week, with the remaining claims requiring additional documentation, and that processing and payment capabilities continue to expand. The accidental death and dismemberment row says the same for pre-outage AD&D claims, with some claims needing additional documentation before payment can be completed. The payment protection row — credit insurance, debt protection and GAP — says claims continue to be accepted and processed and that review of GAP claims submitted after July 11 has begun as additional claims capabilities are restored; July 11 is the date TruStage gives for identifying the attack, so this reads as claims filed during the outage entering review. All three rows previously said only that TruStage's ability to process and pay claims was actively being restored.

This is the first product-level payment timing TruStage has published since it edited its mid-August operational target off the last of its outage pages on August 27, and the first timing of any kind on the dashboards, which otherwise state availability without dates. Read it for exactly what it says. It is an expectation about most claims in two product lines, not a statement that those claims have been paid, and the claims needing further documentation sit outside it. Because the page prints no publication date, “next week” is relative to a date TruStage does not give; read on the afternoon of August 28 it points at the week beginning August 31.

No availability label moved with the wording: submission, processing and payout remain partially available for life, AD&D and payment protection alike. The three rewritten rows were confirmed on the live page after the sweep, and the annuities row still carries the older “actively being restored” wording — so this was a targeted edit to three products, not a template change across the board.

TruStage rewrote two answers on its retirement outage page on the morning of August 28, between our 10:01 a.m. and 12:01 p.m. Eastern sweeps, and moved the shared “Last Updated” stamp on that page and the five other dated outage pages to August 28 at 10:01 a.m. CT. On those five other pages the stamp line is the only thing that changed; the retirement page is the one that was actually edited.

The data-investigation answer was replaced rather than added to. Where it had said conclusions about the scope or impact of the incident would be premature and that TruStage did not want to speculate or get ahead of the facts, it now says TruStage continues a comprehensive forensic and data-impact analysis with outside cybersecurity experts, that establishing whether any information was accessed and how far any impact reaches requires extensive investigation and validation, and that the analysis is “expected to take additional time.” The answer appears twice on the page — once in the participant FAQs and again in the plan-sponsor FAQs — and both copies were replaced. The wording also shifted from the first person to the third: the closing sentence now says that if TruStage determines notifications are required, those communications will be made through the appropriate channels.

The recovery answer took the version already carried on four other outage pages. It describes a deliberate, phased recovery, says systems and applications are being restored carefully so they are secure, stable and checked before going back into service, says many critical capabilities have already been restored with more functionality coming online, and says some capabilities will need additional time. Neither rewritten answer names a service, attaches a date, or reports any finding about data.

With this edit all seven outage sub-pages carry the rewritten data answer, and the earlier premature-and-speculate wording survives on just two tracked surfaces — the consumer FAQ and the Canadian FAQ — both of which keep it and append the forensic paragraph rather than replacing it. Nothing else on the retirement page moved: plan balances and benefits are still described as unaffected, BenefitsForYou.com is still down with interim phone processes in place, and the Retirement Service Center (844.999.2677) and Participant Service Center (800.999.8786) numbers are unchanged. Confirmed against the live page, where the older wording now returns no hits.

TruStage Life of Canada rewrote much of its service-disruption FAQ at trustage.ca between our 8:01 a.m. and 10:01 a.m. Eastern sweeps on August 28. It is the largest edit to that page since it entered the sweep on August 24. The page still carries no Last Updated stamp, so the change is visible only by comparing snapshots, and its status line still reads Investigating.

Four new answers cover billing. TruStage says pre-authorized debit and electronic funds transfer billing activity has resumed for certain customers as part of its phased recovery, and that some customers may therefore see a regularly scheduled premium drafted even though an earlier one went unprocessed during the outage. Representatives still cannot see individual account information or determine the status of a specific premium payment. TruStage states plainly that billing restoration does not mean all systems are back, and warns that customers may hit delays or processing exceptions as services return. The list of unavailable services was rewritten at the same time: claims came off it, and billing changes and payment over the phone were added.

The claims answer changed shape. Where the page previously said a death claim arising during the outage would be processed and paid under the policy terms once TruStage was able, it now tells funeral homes to work with their General Agent to submit the initial notification of loss, and tells beneficiaries to notify the funeral home associated with the policy. It says some claim processing limitations remain but that it expects to handle more claims as functionality returns. The partner answer on new business moved the same way: TruStage says it has stood up temporary capabilities to take in the backlog of new business applications, and points partners to their General Agent for current submission and processing guidance.

On the data question the Canadian page caught up with the US pages rather than moving past them. The older wording — that conclusions are premature and the company will not speculate — is still there, with the same forensic and data-impact paragraph the US consumer FAQ and retirement page have carried since mid-August now appended to it; the question's heading was also corrected from "comprised" to "compromised." No finding has been announced. Read the whole edit narrowly: this is TruStage Life of Canada describing Canadian products and Canadian service, and none of the tracked US surfaces changed in the same sweep. The page also picks up the anti-fraud line already on the US pages — TruStage is not sending past-due notices or premium-payment requests, and a message claiming otherwise should not be clicked, answered with personal information, or paid.

TruStage rewrote two answers on its wealth management solutions outage page on the afternoon of August 27; the snapshot pair places the change between our 2:12 p.m. and 4:01 p.m. Eastern sweeps. The page's "Last Updated" stamp did not move — it has read August 27 at 7:11 a.m. CT since the morning, so the edit is visible only by comparing the text.

The significant change is the recovery answer. Until this afternoon this page still told readers that TruStage rebuilt parts of its infrastructure and "anticipate that the majority of key processes will be operational by mid-August." It was the last outage page carrying that target as a live answer; TruStage had been removing it page by page since August 18. The replacement is the same four-sentence, undated wording now used across the outage family: recovery is deliberate and phased, systems are validated as secure and stable before returning to service, many critical capabilities have already been restored with more coming online, and some capabilities will require additional time.

What matters for a credit union is what did not replace it. No new completion date, no revised target, and no named service. TruStage has not withdrawn the mid-August commitment in words — it has edited it out, and now publishes no recovery target at all on these pages. The phrase survives only in dated historical material: the July 31 and August 13 newsroom releases, which stay posted as records, and the CEO video transcript on the credit-union page. Staff asked when TruStage expects to be done should say there is no public target date rather than repeating mid-August.

The same edit also carried the rewritten data-investigation answer onto this page, saying the forensic and data-impact analysis is expected to take additional time. That rollout now covers six outage pages; the older wording remains on the consumer FAQ, the Canadian FAQ, and the retirement page. No finding on whether any data was accessed has been announced.

TruStage refreshed the credit-union outage page — the one written for our members — on the morning of August 27, and moved the “Last Updated” stamp on it and the five other dated outage pages to August 27 at 7:11 a.m. CT. The edit landed between our 8:01 a.m. and 10:02 a.m. Eastern sweeps. This is the first stamp movement in several days, and unlike several earlier edits the stamp moved together with the content rather than lagging behind it.

Both answers our August 26 items flagged as missing from this page are now on it. The data-investigation answer says TruStage continues a comprehensive forensic and data-impact analysis with outside cybersecurity experts, that establishing whether any information was accessed and how far any impact reaches requires extensive investigation and validation, and that the analysis is “expected to take additional time.” The recovery answer says systems are being restored carefully and validated as secure and stable before returning to service, that many critical capabilities have already been restored with more coming online, and that some capabilities will need longer. Neither answer names a service or attaches a date, and neither reports a finding on data. The data-investigation rewrite reached the preneed page in the same edit, putting it on four pages as of this check. Around midday on August 27 TruStage carried both rewritten answers onto the individual outage page as well, in wording identical to the version here, leaving the consumer FAQ, the Canadian FAQ, and the retirement and wealth-management pages on the older answer.

The claims section opens with new wording: claims payment activities have resumed across several areas of the business, and TruStage continues working through backlogs while expanding capabilities and reducing service disruptions. Read against what it replaced, this is a firmer framing rather than fresh news. The sentence that follows is unchanged — TruStage has started paying preplanning and funeral, GAP, and debt protection and credit insurance claims — and the page's Life and AD&D answers still say pre-outage claims come first and that the backlog will take time. Nothing on the page is newly identified as restored, and the three service dashboards were unchanged at this check.

One piece of member guidance came off the page. The direct-mail answer used to add that no further new mailings would go out in August, that some members might still receive Life direct-mail offers already in progress before the attack, and that licensed AD&D and life call-center agents remained available to help those members complete the mailed application. That paragraph is gone, and the answer now says only that TruStage plans to direct-mail Auto Insurance offers for the month of August. TruStage gave no reason for the removal. The separate answer telling members that new AD&D and Simple Issue life applications must be filed on the paper form TruStage mailed is still there and unchanged.

The remainder of the edit is housekeeping: the lending questions were reordered, “Debt Protection,” “Term Life Insurance” and “Whole Life Insurance” were capitalized, and “You can review the technical FAQs” became “Please review.” The link behind that phrase still resolves to TruStage's outage-information FAQ page. Every change here was confirmed against the live page rather than the extracted snapshot alone.

TruStage rewrote two of the four answers in the outage FAQ on its general business page during the evening of August 26; the snapshot pair places the change between the 4 p.m. and roughly 7 p.m. Eastern sweeps. The page's “Last Updated” stamp did not move for either edit.

The recovery answer is the new part, and it has not appeared anywhere else yet. Asked when the incident will be resolved, TruStage previously gave two sentences that restated the intro at the top of the same page: the attack was broad, parts of the infrastructure were rebuilt, and systems were coming back through a phased approach. The replacement runs four sentences and adds a claim the older answer did not make — that “Many critical capabilities have already been restored,” with additional functionality continuing to come online. It also says systems are being validated as secure and stable before they return to service, and that some capabilities will need more time.

Read it for what it does not say. No service is named as restored, no date or target is attached, and the closing sentence still holds open that some capabilities are not back. It is a firmer description of the same phased recovery rather than an announcement that anything specific is working again, and a credit union should not treat it as confirmation that a particular process has returned. It does sit consistently with what TruStage told partners through trade press on August 21, when contact centers were reported handling more than 42,000 calls.

The second edit is the data-investigation answer that first appeared on the annuity page in the afternoon, saying the forensic and data-impact analysis is expected to take additional time and dropping the earlier language framing conclusions as premature. Its arrival here confirms the rewrite is being rolled out page by page rather than published once. As of this check it stands on two pages, the annuity and business pages, while the consumer FAQ, the Canadian FAQ, and the credit-union, individual, preneed, retirement and wealth-management outage pages all still carry the older wording. That matters for our members in particular: the credit-union outage page, the one written for them, still shows the previous answer to both questions.

Neither edit moved the page's stamp, which still reads August 26 at 8:01 a.m. CT — the same value it carried at the 4 p.m. check, before either change existed. Both edits were confirmed against the live page rather than the extracted snapshot alone.

TruStage rewrote the answer to its outage FAQ on when it will know more about whether data was compromised. The change appeared on the annuity page between 2 and 4 p.m. Eastern on August 26. The new answer says the company continues a comprehensive forensic and data-impact analysis with outside cybersecurity experts, that determining whether any information was accessed and understanding the scope of any potential impact requires extensive investigation and validation, and that because of the complexity the analysis is “expected to take additional time.” It repeats that where notifications are determined to be required, those communications will be made through the appropriate channels.

No finding has been announced. The answer still reports no determination about whether any data was accessed, and it attaches no date. What moved is the framing. The previous version treated any conclusion as premature at this stage, said the company would not speculate ahead of the facts, and described the work as something that may take time. Those sentences are gone, the replacement speaks of TruStage in the third person rather than the first, and it states the additional time as an expectation rather than a possibility. Set against the two-to-three-month estimate trade press reported from TruStage's August 12 update, it points the same way: the data question stays open for a while yet.

Two notes on scope. The rewrite is on the annuity page only so far. At the same 4 p.m. check, the consumer FAQ, the Canadian FAQ, and the business, credit-union, individual, preneed, retirement and wealth-management outage pages all still carried the older wording, so a credit union reading any of those today will see the previous answer. TruStage also made the edit without moving the page's “Last Updated” stamp, which still reads August 26 at 8:01 a.m. CT — the same stamp the page carried two hours earlier without this content. That is a recurring pattern on these pages and a reason not to rely on the stamp to tell you whether a page has changed.

The same edit added one form to the annuity owner resources: a qualified charitable distribution form, filed under withdrawals and surrenders, for contract owners directing an eligible distribution to a charity. It joins the required minimum distribution, systematic withdrawal, partial withdrawal, surrender and direct deposit forms already published there. The forms are reached from the annuity outage page linked above.

TruStage rewrote the billing and claims sections of its credit-union outage FAQ on the evening of August 25; the snapshot pair places the change between the 4 p.m. and 8 p.m. sweeps. It is the first substantial rewrite of this page since August 19, and it moves the payment story forward for the first time in two weeks.\n\nBilling: TruStage says it began drafting recurring credit card payments on August 20, and that as with the earlier ACH restart no customer was double-drafted to make up a payment missed during the outage. Recurring monthly ACH and now card billing are described as resumed for certain life, AD&D and preplanning customers. Paper billing and one-time payments are still unavailable and described as actively being worked on — so the picture is now two recurring methods back and the manual ones still down, where every earlier version of this page had card payments in the same unavailable bucket as one-time. Representatives still cannot verify an individual customer's payment activity. Billing questions are now routed to the individual service hub at trustage.com/outage/individual rather than to unnamed support resources, which is a more useful answer for a member service representative fielding the call.\n\nClaims: the page states that claim payments are underway across preplanning and funeral, GAP, and debt protection and credit insurance. For life and AD&D, core claims processing is still being restored, and TruStage says it will clear claims that were already pending when the outage began before turning to those filed since, cautioning that the backlog will take time. Members can file a first notice of loss at trustage.com/startclaim and get an email confirmation, after which a claims representative contacts whoever submitted it.\n\nThree answers are new and have direct operational consequences for a credit union:\n\nGAP skipped payments. Where slow credit insurance or debt protection claims processing pushes a member past the number of skipped payments their GAP contract allows, TruStage will still count those extra months in the protected balance on a later total-loss GAP claim. It sets the allowance at one additional skipped payment per month the outage runs, using a three-month outage yielding three extra payments as its own example. This is the first accommodation TruStage has published that changes how a contract term will actually be applied, rather than promising a process will return.\n\nNew life applications. Members wanting new AD&D, Simple Issue Term or Simple Issue Whole Life coverage can apply only by returning the paper application from a TruStage direct mail offer. TruStage says these cannot currently be started through its call center or on trustage.com. A member without a mailed offer therefore has no route to these products right now — worth knowing before a branch refers someone. Auto and home is the exception and continues normally through Liberty Mutual and Polly for quotes, purchase, servicing and claims.\n\nConversion deadlines. TruStage says members will not lose coverage because the disruption stopped them acting on a policy, and that it will extend deadlines for policy conversions as processing resumes. That answers a question staff have had since term-conversion notices kept arriving through the outage.\n\nTruStage also says it is still building the processes to capture the GAP and mechanical repair coverage data collected through the workaround and to issue those member contracts, with timing to be announced. The page picked up a browse-topics navigation splitting it into billing and payments, lending products, other products and about the outage. It remains undated, so there is no stamp on the page to tell a reader any of this is new.

TruStage's annuity subsidiaries used a regulatory channel on August 24 to give contract owners the most specific servicing picture yet published. Four versions of a prospectus supplement, all dated August 24, were filed across three registrants — MEMBERS Life Insurance Company (CIK 1562577), the MEMBERS Horizon Variable Separate Account (CIK 1651981) and, appearing in this record for the first time, the CMFG Variable Annuity Account of CMFG Life Insurance Company (CIK 916873). Between them they cover the MEMBERS Zone, MEMBERS Horizon and TruStage Horizon II variable annuities; the TruStage ZoneChoice, ZoneChoice Advantage, Zone Income and ZoneChoice Income index-linked annuities; and the older MEMBERS Variable Annuity, II, III and Choice contracts.

Every version lists the same core set of eleven transactions now supported by interim processes: subsequent purchase payments, systematic withdrawals, partial withdrawals, surrenders, starting lifetime income payments under an income benefit rider, direct deposit changes, transfers among allocation options, changes to allocation instructions, death benefit claims, Section 1035 exchanges into a contract at another insurer, and rollover distributions to an IRA, Roth IRA or retirement account. The last two are worth noting for credit unions fielding questions, because neither the 1035 exchange path nor the rollover path appears anywhere on TruStage's public outage pages.

Two commitments in the filings are new to this record. TruStage says applications it had received in good order before the outage will be treated — in its words — "as if they had been issued" on the date they would otherwise have been issued, and that this carries the Risk Control Account crediting rates and income benefit terms that would have applied. It also states that most requests for financial transactions received in good order since the outage began have been processed, and names what is still queued: allocation changes to Risk Control Accounts at the end of an interest term for the newer contracts, and loans and loan repayments for the older CMFG contracts. Non-financial requests such as address and ownership changes are described as processed when administratively possible.

The version filed for buyers holding an initial summary prospectus for the four ZoneChoice and Zone Income products adds two rights the other versions do not mention: an applicant may cancel a pending application and have the premium refunded, and an owner of a recently issued contract may cancel under the right-to-examine privilege and receive a refund of premium or contract value as their state requires, with the contract value reflecting investment performance including the interim value of anything allocated to Risk Control Accounts. That version also says plainly that the event affected TruStage's ability to take in new contract applications, not just to service existing ones.

The filings restate what TruStage's annuity outage page already tells members — that contract values, account balances and benefits were not affected, that requests are date- and time-stamped on receipt and processed in prospectus order, and that forms are at trustage.com/outage/annuity or can be mailed to Waverly, Iowa. One detail cuts against a discrepancy this tracker flagged on August 20: the supplements give the annuity call center as 800-798-5500, the number on TruStage's policy servicing dashboard, rather than the 855-591-9027 still printed on the annuity outage page. TruStage has still not said which number it intends contract owners to use, and a filed document using one of them is not a statement that the other is wrong.

What this is not: it is not a data-exposure finding. The supplements repeat that TruStage is still investigating the scope and impact of the event, and say nothing about whether information was accessed.

TruStage Life of Canada — the entity that underwrites and administers TruStage Preplanning Solutions products in Canada — publishes a service-disruption FAQ on TruStage's Canadian domain. Nothing on any tracked US surface points to it; it was found by search. It is now part of the snapshot sweep, so future edits will be caught.

Why it matters for a credit union here is scope, not service. This is the first evidence in this record that the incident reached a TruStage affiliate outside the United States, operating under a different regulator. The page says TruStage Life of Canada is a federally regulated insurer, that it has been in regular contact with its regulators throughout the outage including Assuris, which backstops Canadian policyholders, and that it has filed all required notices and continues to meet its regulatory obligations. That is the most direct statement TruStage has made anywhere public about having actually filed with a regulator. Read it narrowly: it is the Canadian company describing its own Canadian filings. It is not a statement that any US federal or state notification has been made, and it is not a finding that data was affected — the same page still calls it premature to draw conclusions about scope or impact, including whether any data was accessed.

The service picture is Canadian and does not track the US pages. At this August 24 check the FAQ's status line read Investigating, and it listed policy cancellations, policy information updates, withdrawals and loans, policy values and quotes, policy changes, and claims as unavailable — a step behind the US posture at the time, where TruStage had been paying claims across several lines for weeks. The page carries no Last Updated stamp, so there was no way to tell from it whether the Canadian operation was genuinely further back or the page had simply not been refreshed, and TruStage has not said which. Nothing here should be read as a change to US service status. TruStage rewrote much of this page on August 28, including that list and the claims answer; the August 28 item carries what it says now.

On money and coverage the Canadian guidance is reassuring and specific: active and grace-period policies hold their status until normal payment processing resumes, applicable grace periods will be extended afterward, recurring credit card and mailed payments are still processing, and pre-authorized bank withdrawals are starting again though possibly off their usual dates. Review periods will be extended where needed. As of this check a death claim arising during the outage would be processed and paid under the policy terms once TruStage was able — wording the August 28 rewrite replaced with a funeral-home and General Agent process — and business written but not yet processed will be honoured if the policy was otherwise issuable and there are no contestability concerns. The Canadian service line is 1-888-977-3752, weekdays 8:00 AM to 5:00 PM CT, and representatives currently cannot reach policy or account information.

Two further points worth carrying. The FAQ states that TruStage is not encouraging or taking part in any effort to replace, surrender, or discontinue in-force coverage because of the incident, so an unsolicited replacement offer is not coming from TruStage — the same fraud-awareness message credit unions have been giving members. And it restates the Mandiant findings already in this record: that the operating environment is "clean, the incident is contained," with no indication of active intrusion and no threat-actor activity seen in the environments in scope since July 11, 2026, with the investigation and recovery still under way.

Note on sourcing: the page carries TruStage's standard proprietary-and-confidential footer, but the rights holder published it publicly on its own domain and directs customers to read it, so the 2026-08-11 carve-out applies and the URL is cited normally. A French counterpart exists and is not yet tracked.

CU Today reports on a Friday afternoon update sent to credit union partners by Chief Administrative Officer Greg Holman, describing a shift from rebuilding foundational infrastructure toward improving customer experience and widening the set of available services. Contact centers for Retirement, Consumer Insurance, Annuity and Pension Risk Transfer are described as operating, having handled more than 42,000 calls since August 13, with billing, payment and policy questions making up most of the volume. Monthly ACH consumer billing has resumed across multiple products and payment methods, and policies stay active while missed payments and other payment problems are worked through.

On claims and retirement, the report says processing has restarted for pre-outage GAP claims, for recurring debt-protection and credit-insurance benefits at higher-volume credit unions, and for select life claims, with both pending and newly submitted claims being worked. Most defined-contribution participants can now request withdrawals, loans and rollovers and retrieve pre-outage account balances, and certain annuity death-claim processing has resumed. TruStage repeats that annuity and retirement plan assets were not affected. An interim digital portal that opened August 19 lets most 401(k) clients submit payroll contributions electronically, processed in payroll check date order as the backlog clears.

Much of this is corroborated by TruStage's own pages captured in the same sweep. The credit union outage page states that claim payments have started across preplanning and funeral, GAP, and debt protection and credit insurance, and that recurring debt-protection benefit payments are being prioritized for the credit unions with the highest volumes; the retirement page confirms an interim payroll submission path; the annuity page shows its contact center open weekdays, 8:00 AM to 5:00 PM CT. The 42,000-call figure and the August 19 portal date appear only in this report and on no TruStage public page as of capture.

One element is carried as reported rather than verified. The article relays that TruStage told partners A.M. Best has affirmed its A (Excellent) financial strength rating; a fresh affirmation dated this week could not be independently confirmed, and A.M. Best's own public statement on the incident, issued August 7, said the company's credit ratings were unchanged. Those may or may not be the same thing, so the rating point should not be repeated as a new development. TruStage's own framing stays cautious: the company says it has "not reached the finish line."

TruStage's Discovery conference page now carries a cancellation notice that ties the decision directly to the incident, saying that because of the cybersecurity attack affecting certain TruStage systems and services, "Discovery 2026 has been canceled." The company adds that key Discovery insights and strategic content will instead be shared through a new thought-leadership series in the coming months. The conference had been scheduled for August 27.

This is the first point at which the incident's effects reach TruStage's event calendar rather than a service line, and for credit unions it is a scheduling question rather than a servicing one: staff who were registered, booked travel, or built August plans around the event are affected directly. The notice says nothing about existing registrations, refunds, or travel already arranged, so a credit union with people booked will need to take that up with TruStage.

Dating note: TruStage's own page carries no date for the notice. The 08/22/2026 line at the top of the page is site chrome that rolls at UTC midnight across the whole trustage.com template, not a content date, and it should not be read as the announcement date. The cancellation was first reported publicly on August 20 by CU Times and covered on August 21 by CU Today, so this item is dated to the earliest public report.

Coverage note for staff: this page sits outside every surface the tracker sweeps. It is not under /outage/, and the newsroom sitemap enumeration only retains /newsroom/ URLs, so nothing in the automated sweep would have surfaced it — it was found through a search. It has been added to the snapshot page list so any follow-up notice, including anything about registrations or refunds, is caught automatically.

TruStage rewrote the contact guidance on its policy and contract servicing dashboard this afternoon. Where each product block previously told customers to "contact us using the phone number listed at the top of the page," the blocks now name a specific contact center and print its number: the Life and AD&D Contact Center at 1-800-779-5433 for life and AD&D policy questions, 1-877-345-4769 for annuity advisors and 1-800-798-5500 for annuity customers, and, for retirement, 1-844-999-2677 for plan sponsors and 1-800-999-8786 for participants. The generic 1-800-356-2644 that had sat at the top of all three status dashboards was removed at the same time; it remains only in the site footer's general "give us a call" block for licensed agents, which is a sales line rather than a servicing one.

No availability status changed on any of the three dashboards in this update. Claims and disbursements were otherwise untouched apart from a heading rename and formatting, so this is a change to how a credit union or member reaches TruStage, not to what TruStage can currently do.

One discrepancy is worth flagging rather than smoothing over: the servicing dashboard gives annuity customers 1-800-798-5500, while TruStage's annuity outage page continues to give 855-591-9027 for the same Annuity Contact Center. Both numbers are live on TruStage pages as of this afternoon and both carry matching click-to-call links, so neither is a typographical artifact. The 1-800-798-5500 line is also the number published on TruStage's standing annuity help pages outside the outage; 855-591-9027 was added to the annuity outage page on August 18, replacing an earlier 855-798-5500 within hours. TruStage has not said which number it intends annuity contract owners to use during the outage, and we are not inferring one — the annuity outage page remains the incident-specific surface, so we continue to list 855-591-9027 first while noting the dashboard's number alongside it.

Verification: every number above was read from the visible page text and confirmed against its click-to-call link. A similar-looking 1-855-591-9026 appears in these pages' underlying site-wide markup but is not offered to readers as a contact number.

On the morning of August 20 TruStage replaced the opening of its credit union outage page with a recovery board and published three new status pages behind it — one for claims, one for policy and contract servicing, one for disbursements — reached from that board or from the tabs at the top of each page. This is the first time the company has stated availability product by product and function by function rather than in prose. Its business outage pages were restamped to August 20 at 11:25 a.m. CT and its consumer pages to 11:15 a.m. CT in the same window.

The board on the credit union page rolls everything up to partially available across all three categories, but the detail pages are far more useful than that summary. Claims for life, accidental death and dismemberment, payment protection — which TruStage groups as credit insurance, debt protection and GAP — Payment Guard and the bond suite are all marked partially available for submission, processing and payout. Mechanical repair coverage claims run through Assurant and are marked fully available, as are claims on brokered commercial products including cybersecurity protection, which stay with the carrier, agent or broker. Annuity death claims can be submitted and processed, but payout is marked unavailable.

Policy and contract servicing is mostly partially available, with two exceptions worth flagging for your staff. Payment Guard servicing is marked unavailable across payments, policy changes and cancellation, with an email address given for questions. Bond suite servicing is unavailable for payments and policy changes, with cancellation partially available. Annuity one-time and recurring payments and contract cancellation are marked available. On disbursements, annuity one-time withdrawals, recurring payments and surrenders are all marked available, retirement is partially available, and life withdrawals, loans and surrenders are marked unavailable — though the request forms can still be reached.

Two cautions. The dashboards carry no last-updated stamp of their own, so nothing on the page tells you when a status last moved; we now capture all three every cycle and will log changes here. And the three labels are TruStage's own — partially available covers everything from a working interim form to a queue that is simply moving slowly, so the note under each product matters as much as the label above it.

TruStage rewrote parts of its Retirement Solutions outage page on the evening of August 19 without advancing the page's own “Last Updated” stamp, which still reads 9:17 a.m. CT that morning.

Two changes carry weight. A new participant question, on what services are unavailable, states on this page for the first time that BenefitsForYou.com was taken offline deliberately as a security measure, so participants cannot sign in to view an account or request a transaction. It says interim processes let some participants call for balance information, request a withdrawal or loan form, and request investment or allocation changes, and that the participants who can use those processes were told so directly by TruStage or by their employer. TruStage says it is still working on interim solutions for the remaining plans.

Second, the plan sponsor section now says an interim process to submit payroll is available for defined contribution plans that do not use TruStage's Choice Group Variable Annuity, and that the plans eligible to use it were contacted separately. That replaces the earlier statement that TruStage was still working on such a solution. A bullet immediately above it still says processing payroll files other than third-party aggregator submissions remains unavailable, so the page presently carries both statements; read the newer bullet as the narrower, current one.

One line moved the other way. Participants seeking distributions and loans are now told to email the participant service center “to determine whether withdrawals are available,” where the page previously told them to email that address to make the request.

Between the 8 a.m. and 10 a.m. sweeps on August 19, TruStage substantially rewrote the credit-union outage page — the page it tells credit unions to work from. It is the first change to that page's content since August 13, and the page carries no last-updated stamp, so nothing on it signals that an edit happened; this tracker caught it by comparing snapshots. The page grew by roughly forty percent. Its question sections were relabeled and reordered: the section headed Outage questions is now headed About the outage, the section headed For credit union leaders is now headed Billing and payments, and two new sections, Lending products and Other products, were added.

The most consequential edit is a removal. The answer to when this will be resolved previously ended by anticipating that the majority of key processes would be operational by mid-August. That sentence is gone. The answer now describes bringing systems and applications back through a deliberate, phased recovery and continuing to make progress, with no date attached. This is the same edit TruStage made to its consumer outage page on the morning of August 18 and its retirement page that afternoon. Three of the five outage pages that carried the target have now dropped it; the business hub and wealth-management pages still carry it, as do the August 13 and August 14 newsroom releases. The target also survives inside the CEO video transcript embedded further down this same page, so a credit union can still read the mid-August promise on the page that has just abandoned it.

On the data question TruStage holds its position that conclusions about scope or impact would be premature, but the answer is now longer. It says a comprehensive forensic and data-impact analysis is under way with the assistance of outside cybersecurity experts, that the complexity of that work means it may take time to determine what information, if any, was affected, and that if it concludes notifications are required it will communicate “through the appropriate channels.” That language reached the consumer page on August 18; this is the first time it has appeared on the partner-facing page. No interval is attached to it. The two-to-three-month estimate reported in mid-August is still a partner and trade-press figure rather than something stated on this page.

Billing is where the page adds the most. Seven answers are new. TruStage says recurring ACH billing activity has resumed for certain Life, AD&D and Preplanning customers as part of the phased recovery. It answers directly why billing came back before claims payment capability: different services need different controls and validation before they can be restored safely, and the ability to pay premiums and keep coverage in force was the concern customers raised most often. It draws the limit explicitly — billing restoration is one step and does not mean systems are back online — and warns that customers may hit delays or processing exceptions as services return. It explains why a customer may see an August premium drafted when a July premium was not: recurring payments are restarting from details already on file. It repeats that representatives cannot see individual account information or determine the status of a specific payment. And it tells credit union staff what to say when a member calls about billing activity, which is to point them to available customer support.

A new Lending products section consolidates operational guidance that had largely lived in TruStage's partner materials rather than on this page. Credit unions whose data processor submits monthly Credit Insurance or Debt Protection files need do nothing; those that submit directly should hold their files, and all should retain monthly premium reports, until TruStage says receipt and processing are restored. GAP waivers and mechanical repair certificates issued under the approved outage procedures will be honored. Credit Insurance, Debt Protection, GAP and mechanical repair coverage will not be canceled for non-payment during the disruption. A first notice of loss process is available while claims payment capability is being restored, and mechanical repair claims are unchanged, going to Assurant, which can pay the repair facility directly. Member-level Credit Insurance and Debt Protection cancellations still work, and where a refund is needed the credit union may issue it and submit to TruStage later. Whether to allow late or skipped payments for members awaiting a claim decision is left to the credit union. Credit unions are told to release letters of guarantee on total-loss settlements without waiting for TruStage, and that neither they nor their members will be penalized for doing so once the GAP claim is adjudicated. The 120-day window to qualify for the GAP PLUS benefit will be extended by the length of the outage; TruStage's own example is that a 60-day inability to pay Plus claims would extend the filing window to 180 days.

One change is a subtraction credit unions should notice. The description of the July 29 continuity process for recurring Debt Protection benefit payments has been replaced. Gone are the statements that payments are issued as a single lump sum reflecting the prior month's recurring payments, that the lump sum carries no member-level ledger so the claims team will contact participating credit unions with the detail, and that TruStage was starting the process for credit unions that received six or more recurring member benefit payments in the previous month. The replacement says payments are being prioritized for credit unions with the highest volume of approved recurring benefits and will continue to expand as recovery progresses, and directs credit unions with questions about a specific member to the claims team. The threshold that told a credit union whether it was in scope is no longer published.

Four other answers are new. A credit union may remove its Protection Advisor Expert connectivity credentials so it can test connectivity before all its lenders return; if it does, PAX will run as a standalone version when it comes back, and restoring connectivity would have to be set up again with TruStage and the systems provider. Business Protection policy servicing requests, including certificates of insurance and updates to vehicles or locations, now go to BusinessProtection@trustage.com. The Required Renewal Questionnaire is unavailable, with additional time to be given once system functionality returns and credit unions to be notified when it is back. On marketing, TruStage says its August direct mail is limited to auto insurance offers, that some members may still receive life offers that were already in progress before the attack, and that its licensed AD&D and life insurance call center agents remain available to help those members complete a direct mail application. That last line is about sales support for direct mail, not the life servicing contact center, whose reopening TruStage has still not confirmed anywhere in the tracked record.

What did not change is worth stating. The two payment options under the temporary GAP claim payment process that began August 12 are still unnamed. The lending claims instruction was only tightened in wording, telling credit unions to submit new claims through the approved claim-start process at trustage.com/startclaim. And the page remains undated, so the next edit will be just as silent as this one.

Between the 10 a.m. and noon sweeps on August 19, TruStage rewrote the claims answer on its credit-union outage page — the second content change to that page in one day, after the larger rewrite caught between the 8 and 10 a.m. sweeps. The answer previously described restoring systems and processes in a controlled and secure manner and left claim payment as something that would happen later. It now says claims remain a top priority and that TruStage has started paying claims across its business, naming preplanning and funeral claims, GAP claims, and debt protection and credit insurance benefits. A new paragraph says core Life and AD&D processing capabilities are being restored, that claims pending at the time of the outage come before claims received afterward, and that working through the backlog will take time. The GAP paragraph shifted from future to past tense: the temporary process began August 12.

None of that is new information. Every element matches TruStage's August 13 newsroom release, which this tracker already carries. What changed today is where it appears. Until this morning, the page TruStage directs credit unions to work from did not say that any claims were being paid at all — so a credit union following that instruction had no way to learn from the page that GAP or debt protection claim payments had resumed in any form.

The limits are unchanged and still on the page. TruStage says it has no product-specific claim payment timelines, that some servicing and claims-related activities remain limited, and that the temporary GAP process covers only open and pending claims established before the attack — claims filed since, through the interim intake form, are still excluded. The page carries no last-updated stamp of any kind, so nothing on it signals that an edit happened; this tracker caught it by diffing snapshots.

TruStage rewrote its consumer service-disruption FAQ between the 10 a.m. and noon sweeps on August 19. One answer contains something that has not appeared anywhere in this tracker's snapshot record before: the coverages whose grace periods will be extended once payment processing resumes now include Payment Guard Advantage, alongside Life, AD&D and Preneed. Payment Guard is a lending product sold through credit unions, so for the first time the grace-period commitment reaches borrowers and not only insurance policyholders.

The same page gives two different lists. The answer on whether coverage will lapse says grace periods will be extended for Life, Accidental Death and Dismemberment, and Preplanning Insurance — the wording TruStage put on its preplanning page on August 18. The answer on what to do once payment processing resumes says Life, AD&D, Preneed and Payment Guard Advantage. Preneed and Preplanning are the same line; Payment Guard Advantage appears in only one of the two answers. TruStage has not said which list is complete, and nothing on the page indicates whether the shorter one is simply older text left in place. A credit union asking on a borrower's behalf should treat the scope as unsettled rather than assume the longer list governs.

The rest of the rewrite is catch-up. A new question on when a claim will be processed or paid carries the August 13 release's claims language — payments started across preplanning and funeral, GAP, and debt protection and credit insurance, with Life and AD&D processing still being restored and pre-outage claims worked first. The retirement answers now say online account access is limited for plan participants, that balances and plan benefits are unaffected, and that some participants may request withdrawals and loans by phone if their plan allows and get balance updates the same way. The data-investigation answer picks up the paragraph about a comprehensive forensic and data-impact analysis run with outside cybersecurity experts, which has been on the individual and annuity outage pages since August 18.

A dating note: the page's own status block still reads August 18 at 11:15 a.m. CT. Its content changed today and the stamp did not follow — a pattern this tracker has now recorded several times across the TruStage outage family, and the reason the routine diffs page bodies rather than trusting timestamps.

TruStage restamped six of its dated outage pages to August 19 at 9:17 a.m. CT — the first movement since August 18 at 10:08 a.m. CT — and rewrote one of them. The business page at trustage.com/outage/business is the one that changed; the other five carry only the new timestamp and are otherwise word-for-word identical. All six still read Investigating.

The change is the removal already made elsewhere. The answer to when this will be resolved no longer anticipates that the majority of key processes will be operational by mid-August. It now describes bringing systems and applications back online through a deliberate, phased recovery and continuing to make progress, with no date attached. TruStage made the same edit to its consumer page on the morning of August 18, its retirement page that afternoon, and its credit-union page on the morning of August 19. With the business page, four of the five outage pages that carried the target have dropped it.

One holdout remains. The wealth-management page still carries the mid-August sentence word for word. The credit-union page also still contains the phrase, but only inside the transcript of the CEO video recorded earlier in the incident — a fixed recording, not current guidance — and TruStage's August 13 and August 14 newsroom releases carry it as dated historical statements. So the target has not been formally withdrawn anywhere; it is being edited out page by page, and one live page still states it.

The business page also picks up the data paragraph that reached the individual and annuity pages on August 18: TruStage says it is running a comprehensive forensic and data-impact analysis with outside cybersecurity experts, that the complexity of that work means it may take time to determine what information, if any, was affected, and that it will communicate through appropriate channels if notifications turn out to be required.

TruStage added a direct deposit form to the owner resources on its annuity outage page on the evening of August 19, again without moving that page's “Last Updated” stamp of 9:17 a.m. CT. Contract owners can now change where their annuity payments are sent, either by signing electronically through TruStage's forms partner in single-owner or joint-owner versions, or by downloading a printable form. Two resource headings were relabeled in the same edit: allocation changes and transfers are now grouped together, as are systematic withdrawals and required minimum distributions.

Two questions came off the page's outage FAQ at the same time, one on filing a death claim during the outage and one on how to withdraw funds or cancel an annuity. Neither capability was withdrawn. The page still links out to start a new death claim, and the partial withdrawal, surrender, application cancellation and right-to-examine forms all remain in the owner resources section above. The effect is to route contract owners to the forms rather than to an FAQ answer, which is worth knowing if your staff were pointing members at those questions.

Between 4:00 and 6:00 p.m. Eastern on August 18, TruStage replaced the standing red alert banner that sits at the top of its public pages. The previous line, in place unchanged in this tracker's snapshot record since it began on July 20, told visitors the company's systems were down while it investigated a recent cybersecurity attack and that teams were working on a resolution and activating business resiliency plans. The replacement says the organization continues to restore systems following the attack, that significant progress has been made, and that some services remain unavailable while it works to restore operations safely and securely.

The change appeared simultaneously on twelve TruStage pages in this run's sweep — the outage hub and all seven of its sub-pages, plus the three tracked newsroom releases and the newsroom index — which is what identifies it as a single site-wide template edit rather than an update to any one page. It was verified against the live site, not only against the snapshot: the outage hub returns the new wording and zero occurrences of the old.

What it does not do is change any service. No product was named as restored, no date was given, and the banner keeps an explicit statement that some services are still unavailable. The individual outage pages were otherwise byte-identical to the 4:00 p.m. sweep, and every “Last Updated” stamp on the outage family held at its earlier time — August 18, 10:08 a.m. CT on the six dated sub-pages and 11:15 a.m. CT on the consumer FAQ — so nothing on those pages moved with it.

It is still worth recording, because this banner is the first thing any member or credit union sees on TruStage.com and it is the company's shortest public characterization of its own status. After 29 days of describing the situation as systems being down and under investigation, TruStage now describes it as a restoration in progress.

TruStage rewrote the participant section of its retirement outage page late on August 18, adding two answers that describe interim ways to get money and information out of a plan while systems are still offline. Participants in most defined contribution plans — TruStage names 401(k), 403(b), governmental 457(b) and tax-exempt 457(b) — are told to email participantservicecenter@benefitsforyou.com to request a distribution or a loan. Account details can be obtained by calling the Participant Service Center at 800-999-8786, and TruStage says scheduled annuity and periodic benefit payments are being processed as usual. The page repeats that account balances and plan benefits are unaffected.

The mid-August target came off this page in the same edit. The "When will this be resolved?" answer previously ended by anticipating that the majority of key processes would be operational by mid-August; it now describes a deliberate, phased recovery with no date attached. That makes the retirement page the second to drop the target in one day, after the consumer outage page did so this morning. Checked against this run's own snapshots, the target still stands on the business, credit-union and wealth-management outage pages, in the August 13 and August 14 newsroom releases, and in CrossState's resource page.

The data-investigation answer also picked up the language that first appeared on the consumer page this morning: a comprehensive forensic and data-impact analysis with outside experts, a caution that its complexity means it may take time, and a statement that TruStage will communicate through appropriate channels if it determines that notifications are required. That wording is now on three of its outage pages — consumer, annuity and retirement — having been on none of them before today.

One removal is worth noting alongside the additions. The page previously carried a "What services are unavailable?" answer stating that BenefitsForYou was offline and that contribution and investment election changes, investment trade requests and beneficiary election updates could not be accepted. That question and answer are gone, and the phrase no longer appears on any TruStage page this tracker monitors. Nothing on the page says those functions have returned, and the BenefitsForYou portal still redirects to this outage page, so the disclosure was withdrawn rather than superseded. As with the annuity edit earlier today, TruStage made these changes without moving the page's "Last Updated" stamp, which still reads August 18 at 10:08 a.m. CT.

TruStage rewrote its funeral preplanning outage page this evening, between the 6 p.m. and 8 p.m. sweeps. Until tonight the page promised to extend “applicable grace periods” once payment processing resumed without saying whose. It now says TruStage will extend grace periods for Life, Accidental Death and Dismemberment, and Preplanning Insurance. That is the first time in the tracked record — across more than 1,450 page snapshots since July 20 — that TruStage has attached product names to the grace-period promise.

The more consequential half is a new limit. A rewritten answer says TruStage “continues to evaluate” how premium payments missed during the disruption will be handled, and that it will communicate directly with affected customers about any action required. So the two halves point in different directions: the extension of the grace period is now confirmed and scoped, while the treatment of payments that were skipped during the outage is explicitly still open. A member whose July premium never drafted has a coverage assurance but no answer yet on what they will owe or when.

Most of the rest of the rewrite is content this tracker already logged this afternoon from the consumer page, now propagated to preplanning: the four billing-restoration answers, including that recurring ACH billing has resumed for certain Life, AD&D and Preplanning customers, and that billing restoration does not mean systems are back online. The forensic and data-impact paragraph, with its first mention of possible notifications, has now reached this page as well. The claims answer was reworded to say claims will be processed as operational capabilities are restored.

Dating and verification notes. The page still reads “Investigating,” and its “Last Updated” stamp still says August 18 at 10:08 a.m. CT — unmoved despite a substantial rewrite, the fifth time today a tracked page changed without its stamp moving. The Mandiant investigation memo has not been withdrawn: the spelled-out URL disappeared from the visible text only because the reference became a hyperlink, and the link is still on the page. Nothing in this rewrite says the outage is over, and the mid-August target still stands on six other tracked pages.

TruStage restamped six of its dated outage pages to August 18 at 10:08 a.m. CT this morning — the first movement since August 17 at 9:32 a.m. CT — and rewrote one of them substantially. Five carry only the new timestamp and are otherwise word-for-word identical; the consumer page at trustage.com/outage/individual is the one that changed. All six still read "Investigating."

The most consequential edit is a removal. Until this morning that page answered "When will this be resolved?" by saying TruStage anticipated the majority of its key processes would be operational by mid-August. That sentence is gone. The answer now describes bringing systems and applications back through a deliberate, phased recovery and continuing to make progress, and it attaches no date at all. Today is August 18, so the target it replaced has passed. The mid-August goal has not been withdrawn everywhere — it still appears on the credit-union, business, retirement and wealth-management outage pages and in TruStage's August 14 recovery-progress release — so this is a change to the page members read, not yet a company-wide restatement. Whether the partner-facing pages follow is worth watching.

Billing is where the page moved forward rather than back. Four answers are new. TruStage says recurring ACH billing activity has resumed for certain life, AD&D and preplanning customers as part of its phased recovery, the first time preplanning has been named in that group. It explains why a customer may see an August premium drafted when a July premium was not — recurring payments are restarting from information already on file — and repeats that representatives cannot see individual account information or confirm the status of a specific payment. It sets out why billing was prioritized: keeping coverage in force was the concern customers raised most. And it draws the limit explicitly, saying billing restoration is one step and does not mean systems are back online, while warning that customers may hit delays or processing exceptions as services return. Recurring credit card and one-time payments are still unavailable.

Two other answers were expanded. On retirement accounts, the page now says online access remains limited for plan participants, that balances and plan benefits are unaffected, and that some participants may be able to request withdrawals and loans by phone where their plan permits, along with balance updates — detail TruStage had put in its August 13 release and partner materials but had not carried on the consumer page until now. On the data question, TruStage still declines to draw conclusions, but adds that it is running a forensic and data-impact analysis with outside cybersecurity experts, that the complexity means the work may take time, and that it will communicate through the appropriate channels if it determines notifications are required. That is the first time any tracked TruStage page has raised the prospect of notifications. It still attaches no interval; the two-to-three-month estimate reported in mid-August remains a partner and trade-press figure rather than something on this page.

What did not change matters for credit unions. The claims answer was only softened in wording, to say claims will be processed and paid as operational capabilities are restored. The credit-union outage page is unchanged for a twenty-fifth consecutive sweep, remains undated, and still carries both the mid-August target and the two still-unnamed GAP payment options. The consumer FAQ and outage-information pages are also unmoved, still stamped August 17. The practical effect for frontline staff: a member who asks TruStage's own consumer page when this will be over now gets no date in reply.

TruStage rewrote its annuity outage page this afternoon, adding a section headed "We're here for you" that says the Annuity Contact Center "is now open" Monday through Friday, 8 a.m. to 5 p.m. CT, and gives the number 855-591-9027. Representatives can confirm the status of withdrawals and surrenders, provide contract values, and help with the forms published on the page. They will discuss account-specific information only with the contract owner and the representative of record, and TruStage warns that call times may run long.

The page also reports movement on payments. TruStage says all outstanding monthly annuity systematic withdrawals have been processed, and that monthly withdrawals will now be processed on their scheduled payment dates. For ZoneChoice Advantage, ZoneChoice Income, ZoneChoice contracts issued on or after June 10, 2023, and most SPIA and annuitized contracts, existing quarterly, semi-annual and annual systematic withdrawals are being processed on schedule as well. TruStage is candid that most other non-monthly arrangements were not identified through its interim processing and that it is still working to find them, and it asks contract owners who missed an expected payment to call. Three new downloadable forms appeared alongside this — a beneficiary change form, a required minimum distribution form, and a systematic withdrawal form.

This matters beyond annuities because it is the first time TruStage's own pages have confirmed a call center reopening in the past tense. Trade press reported on August 12 that the life and annuity call centers were set to open Friday, August 14, and that claim sat unconfirmed for four days and fourteen tracker runs. The annuity half is now confirmed by TruStage directly. The life side is not: no TruStage page yet says a life contact center has reopened, and the consumer outage page still says representatives cannot access policy or account information or process transactions.

Two notes on how this arrived. TruStage made the edit without moving the page's "Last Updated" stamp, which still reads August 18 at 10:08 a.m. CT — the same stamp the page carried two hours earlier with none of this content, so the timestamp understates the change. Separately, the annuity page's data-investigation answer now carries the same language that appeared on the consumer page this morning: a comprehensive forensic and data-impact analysis with outside experts, a caution that complexity means it may take time, and a statement that TruStage will communicate through appropriate channels if it determines notifications are required. That language is now on two of its outage pages.

Correction, recorded August 18 at 4:01 p.m. CT: TruStage changed this number within two hours of publishing it. The page carried 855-798-5500 when the reopening first appeared and now carries 855-591-9027, with a matching dial link; the older number no longer appears anywhere on TruStage's outage pages. This tracker published the earlier number at 2:07 p.m. and has corrected it here and throughout the page. Credit unions that copied the first number into their own materials should replace it.

The news site of the National Association of Plan Advisors covered the incident on August 17, the first retirement-industry trade coverage this tracker has logged. It reports that TruStage describes its operating environment as clean and contained on Mandiant's assessment, with no active intrusion, and that recovery continues across a network TruStage has had to rebuild in part. It repeats TruStage's position that annuity and retirement plan assets were not affected, and says most defined contribution participants, excluding certain legacy platforms, can request withdrawals, loans and account balance updates by phone.

The piece is largely a relay of TruStage's own statements. Its independent content is a quote of TruStage's chief executive on the likely cause, drawn from earlier CU Today reporting, and practical suggestions from an outside retirement consultancy for plan sponsors waiting on the recovery. One timing caveat for reviewers: it carries the mid-August operational target that TruStage has since edited out of the FAQ answers on all of its outage pages.

TruStage published this release in its newsroom under the headline "TruStage confirms clean, isolated technology environment," dated August 13. It is the public counterpart to the August 12 partner email already recorded here — the entry for that email had to link the credit-union outage hub instead, because none of its content had reached a public TruStage page. It now has, at a citable URL.

One element is worth separating from the restatement. TruStage says the clean environment is segmented from systems that were impacted, potentially impacted, or still under investigation, calls it the foundation of the remaining restoration work, and draws a practical conclusion from it: partners may safely use TruStage communications, including the links it provides through its established channels, while systems come back in phases. For a credit union weighing whether a message that appears to come from TruStage can be trusted, that is the first authenticity statement the company has made in its own newsroom.

The balance repeats what this tracker already carries: a mid-August target for basic servicing across most businesses including reopened contact centers; the retirement call center open; claims being paid across preplanning and funeral, GAP, and debt protection and credit insurance, with life and AD&D processing still being restored and pre-outage claims worked before newer submissions; annuity and retirement plan assets unaffected; billing resumed to avoid coverage disruption; and roughly two to three months before the data investigation produces answers.

Two dating notes. The release says the life and annuity call centers "will open by end of week" — future tense, written the day before the reported August 14 date — so it does not confirm that the reopening happened, and no source yet does. And it surfaced four days after publication: TruStage's newsroom index builds its article list in the browser and returns no article links to either a plain fetch or a rendering one, so a new release is not discoverable from any page this routine tracks. This URL has now been added to the snapshot sweep.

TruStage rewrote the claims and payments answers on its credit-union outage page (snapshots place the change between 4:01 and 7:04 p.m. ET), and one part has not appeared on any TruStage page before: a temporary process to resume GAP claim payments began Wednesday, August 12, covering open and pending claims established before the attack, with two payment options to be available. The page does not say what the two options are — expect to be told separately.

The limit matters as much as the restart: claims submitted after the attack through the claim intake form are not part of this process at this time. A credit union that filed through the interim intake route since mid-July should not read this as covering those claims. Otherwise the page repeats its position — representatives can take inquiries, some servicing and claims activity remains limited, and no product-specific claim payment timelines are available.

The same rewrite finally carries TruStage's August 12 billing detail onto the partner-facing page, closing a gap flagged yesterday: the August 4 ACH restart for certain life and AD&D policies, the late-July and August due dates being worked through, recurring card and one-time payments still unavailable, and card billing expected before direct bill. It mirrors the honored-by-date-received guidance for outage-period cancellations and changes, and routes life and AD&D changes to the mail-in forms page.

Two things did not move: the page remains undated, and it says nothing about the life and annuity call centers reported as due to open Friday, August 14.

Credit Union Daily reported a new TruStage recovery update in which president and CEO Terrance Williams said the company is making 'steady advancements in restoring our technology environment' and remains on track for most key processes by mid-August. Per the report: the retirement contact center has reopened and the life and annuity centers are due August 14; claim payments have begun moving across business lines, with the pre-outage backlog of life and accidental death claims prioritized; billing has resumed so coverage is not disrupted; and defined contribution participants may request withdrawals and loans by phone. Retirement and annuity account values remain unaffected.

On data, Williams reportedly said it will likely be two to three months before the company can say whether member or employee information was involved — the first time any interval has been attached to that answer.

The statement is undated and appears on no TruStage public page as of capture; TruStage's own pages were unchanged this morning, so this is recorded as reported rather than confirmed. TruStage's own August 12 email update to partners, received by the association on August 14, has since confirmed the account firsthand — see the entry logged for that update.

TruStage's August 12 email update to partners, signed by president and CEO Terrance Williams, reached the association directly on the morning of August 14. It confirms firsthand what this tracker had carried only through trade-press and peer-association relays: basic servicing targeted for mid-August, the retirement call center open with the life and annuity contact centers opening Friday, August 14, billing resumed so coverage is not disrupted, and Mandiant's confirmation of the clean, isolated environment built apart from impacted systems.

Two details had not appeared in any relay. Claims are being paid across the business including preplanning and funeral claims — alongside the GAP and debt-protection restarts already tracked — with life and AD&D processing still working pre-outage pending claims before newer submissions. And the majority of defined-contribution participants, other than those on certain legacy platforms, can request withdrawals and loans where their plan allows and ask for account-balance updates over the phone.

On data, the update repeats the two-to-three-month estimate for complete answers and the commitment to notify affected parties first if member or employee data is compromised.

Because this is a communication addressed to partners rather than a public page, this entry links TruStage's public credit-union outage hub instead of the email. None of this content appeared on TruStage's public pages as of this morning's sweep.

CU Today reported that TruStage, in its latest update to credit union partners, said it remains on course for most key processes running by mid-August, with basic servicing available across most businesses. The retirement contact line is already taking calls; the life and annuity lines were set to reopen Friday, August 14 — with warnings to expect heavier volumes, longer handling times, and limits on what representatives can do at first.

On data: TruStage expects the forensic review will likely need another two to three months before it can say whether credit union member or employee information was involved. The report names Epiq Global as the firm handling data analysis alongside Mandiant on forensics, and relays Mandiant's finding of 'no indication of an active intrusion' since the July 11 detection — consistent with the memo TruStage published August 10. Whether any data was actually accessed or taken remains undetermined.

This update appears on no TruStage public outage page as of capture, so it is recorded as reported rather than confirmed.

TruStage re-stamped its dated outage pages on the afternoon of August 12 and used the individual page to put detail behind its billing position. The payment answer now carries a start date: recurring ACH premium collection began coming back on August 4 for certain life and AD&D policies, and TruStage is working through policies whose due dates fall in late July and August. Recurring credit card and one-time payments remain unavailable; TruStage expects card billing to return ahead of direct bill, which will take additional time.

That partially answers the eligibility question flagged as unanswerable on August 11 — it describes a scope, though still no way for a member or credit union to confirm whether a particular policy sits inside it.

Two new answers concern servicing: requests to change or cancel a policy submitted while systems were down may not yet be reflected in billing; TruStage will process them as capability returns and honor each by the date received. Life and AD&D changes are routed to the mail-in service forms page, itself reorganized the same evening.

Quieter changes worth flagging: the individual page shortened weekday outage-line hours from 5:30 to 5:00 p.m. CT (Saturday unchanged), and the credit-union page picked up none of the new billing language — staff should read the individual page directly. Status still reads Investigating.

TruStage improved the contact and servicing posture on its Retirement Solutions page. Where it previously said representatives could not access account information or process transactions, it now says they have limited access to account information and limited transaction capabilities. Two dedicated lines replace the general outage number: a Retirement Service Center at 844-999-2677 for plan sponsors, advisors, and third-party administrators, and a Participant Service Center at 800-999-8786 for participants — weekdays 8:00 a.m.-5:00 p.m. CT. Neither number had appeared on any TruStage outage page previously captured.

Two cautions for credit unions passing this along. This is a change in what staffed phone lines can do, not a systems restoration: BenefitsForYou is still offline, contribution and investment election changes, trades, and beneficiary updates still cannot be accepted, and status still reads Investigating. The new lines also carry narrower hours than the general line they replace, which ran to 5:30 p.m. weekdays and covered Saturdays.

TruStage did not advance the page's timestamp for this change, and the later August 11 family re-stamp accompanied a separate change — so the date recorded is the date this tracker verified the new language.

TruStage rewrote its outage-information status page. The heading now describes an actively investigated cybersecurity attack (previously incident), and the body matches the July 31 press release: the attack was broad, portions of the network and systems are being rebuilt rather than switched back on, and services restore in a deliberate sequence protecting employees, partners, members, and customers.

The closing pointer changed too: the Technical Incident FAQs reference that stood since July has been replaced by a new Investigation FAQs document dated August 10, described as answering vendors' and partners' questions about what happened, what steps TruStage has taken, what is known, and what remains under investigation. The link opens TruStage's document viewer displaying the four-page PDF rather than downloading a file.

Operationally nothing changes — status still reads Investigating and the mid-August target is unchanged — but the new document is TruStage's consolidated channel for the vendor-management questions credit unions are expected to ask their vendors after an event like this. It is linked under Resources below.

TruStage added the same new question to five of its outage pages and a matching line to the hub — the most substantive change in a week. The question: has a cybersecurity expert provided information on whether the incident is contained and whether TruStage is operating in a clean, safe environment as systems return? TruStage answers yes, says it continues to work closely with Mandiant, and directs readers to a Mandiant investigation memo dated August 10, published at a public address on TruStage's own site. The memo is linked under Resources below — a three-page PDF that downloads rather than opening as a web page.

Why this matters: TruStage has said since July 31 that the incident was contained, but that was TruStage speaking about itself. This is the first time the outside forensic firm's assessment is public under Mandiant's name — the first time the containment claim is sourced to something a reader can inspect.

On the question credit unions ask most, Mandiant writes that it has not observed the threat actor interacting with files shared with third parties, or with third-party systems, portals, VPNs, APIs, or other environments connected to TruStage. Read that with the limit Mandiant places on it: the preceding sentence confines its findings to the environments within its investigation's scope, and the memo does not define that scope. It is not an unqualified all-clear for every connected credit union system, and it says nothing about whether data was accessed — which TruStage still calls premature to judge. It does not replace your own review of any connection you maintain to TruStage.

It is also not a restoration announcement: every page still shows status Investigating and the mid-August target is unchanged. The five pages carrying the question are credit union, business, annuity, preneed, and retirement; individual and wealth management had not picked it up at capture. TruStage re-stamped the outage family August 11 at 12:13 p.m. CT alongside this change.

TruStage rewrote the payment section of its individual and credit-union outage pages late on August 11 (snapshots place the change between 4:25 and 6:12 p.m. CT). Recurring ACH premium payments are beginning to resume for some eligible customers, drawing on payment information already on file. Recurring credit card payments and one-time payments are still unavailable, and because account access remains limited, representatives cannot verify an individual customer's payment activity or policy status.

This is the first time TruStage has said any premium payment processing is actually restarting rather than promised for when systems return — a concrete restoration step. Read the scope carefully before passing it to members: one payment method, only 'some eligible customers' in TruStage's words, and no way for a member or credit union to find out whether a particular policy is in that group.

The individual page also restructured its coverage answer — customers will not lose coverage because they were unable to pay during the disruption; active and grace-period policies keep their status until normal processing resumes, with accommodations including extended grace periods to follow. The warning that TruStage is not sending premium-payment requests or past-due notices carries over and has been added to the credit-union page, so staff fielding a call about a suspicious notice can point to the page written for them.

Neither page advanced a date stamp for this change, and status across the outage family still reads Investigating.

The insurance ratings agency AM Best published a comment on August 7 at 11:21 a.m. Eastern saying its credit ratings for TruStage Financial Group, Inc. and Union Security Insurance Company remain unchanged following TruStage's disclosure of the July 11 cybersecurity incident. AM Best said the disruption “has not had a material impact on the credit profile” of the enterprise, and that it believes TruStage is taking the necessary actions to address the attack.

What the comment rests on matters. AM Best attributes its view to its own interactions with TruStage's executive management, and it repeats management's position that the threat was contained rather than reaching that conclusion itself. In the same comment it records that the attack critically affected TruStage's technology infrastructure and that some operations remained shut down as of that date. So this is a judgment about financial strength and credit profile, not an independent finding about the incident's technical scope or about member data.

AM Best also said it will keep watching for signs that the incident has damaged TruStage's ability to conduct business, harmed its reputation, or would change the agency's view of TruStage's enterprise risk management, which it described as appropriate at the time of writing. That is a stated condition on the comment, not a prediction.

Two dating points for credit unions reading this. The comment is nearly four weeks old and predates TruStage's August 13 release on a clean, isolated environment, so it does not take that release into account. It also appears on none of the twenty-five TruStage or partner pages this tracker sweeps; it was found through a search on September 2 and read on AM Best's own news service rather than through a wire redistribution.

TruStage rewrote its Wealth Management Solutions outage page and answered a question it had deferred since the outage began: advisors and credit unions can get into Salesforce through a direct login, with instructions from their assigned Advisor Manager Specialist or Regional Program Consultant.

One caution for program staff: the page's own 'What you should know' paragraph still says advisors cannot access Salesforce for client-specific notes — the old and new statements sit unreconciled on the same page. Treat the direct-login route as the newer of the two and confirm its scope with your TruStage contact.

The page also adds a compensation answer for the second half of July — managed and dual advisors paid on the regular schedule, credit unions paid the same amount as the first half, which was based on a six-pay-period average — and finally adopts the mid-August recovery answer and standard recovery lead, making it the last outage sub-page to catch up.

A new question on TruStage's individual outage page addresses policyholders who have been approached about replacing their insurance with another company's. TruStage answers plainly: such offers do not come from the company, and it is not encouraging, facilitating, or taking part in any effort to replace, surrender, or discontinue in-force coverage — because of the incident or as part of recovery.

Worth passing to members: an insurer's systems being offline is exactly the circumstance in which policyholders may be told their coverage is at risk and pressed to switch. TruStage is now on record that it is not the source of those approaches.

TruStage did not advance the page's timestamp (still August 6), so the date recorded is the date this tracker verified the answer was publicly visible.

TruStage added a product question to its credit-union outage page confirming that auto and home insurance is operating through its partnership with Liberty Mutual and Polly: members can get quotes, buy coverage, have policies serviced, and reach claims support, none of it interrupted by the attack. One caveat: while the servicing experience 'remains largely unchanged,' the online experience may look different for now.

This is broader than what was previously on the record — the July 23 video had Liberty Mutual and Polly processing new business from direct-mail leads; TruStage now describes the full policy lifecycle, servicing and claims included, as running without disruption. For staff fielding member questions, it is one of the few product lines that can be discussed as working normally.

The credit-union page carries no date stamp, so the date recorded is the date this tracker verified the answer was publicly visible.

TruStage substantially rewrote its Retirement Solutions outage page under an August 6 timestamp. It now says it will introduce temporary processes while recovery continues and is contacting plan sponsors as solutions become available. On payroll, where the page previously said flatly that non-aggregator files could not be processed, TruStage now says it is working on an interim solution and will share news with sponsors.

Statements moved from open-ended delay to specific commitments: quarterly paper statements for the period ended June 30 have been mailed, and participants who elected electronic statements will be sent a paper copy, expected to mail the week of August 10 — some who signed up for paper may receive a duplicate.

Two items also quietly left the unavailable list: the sentence about the Participant Service Center phone and email being down, and loan and distribution requests among those TruStage cannot accept. TruStage did not describe either removal as a restoration, and this tracker does not treat it as one.

TruStage extended the self-service annuity forms introduced August 4 with two further routes: an e-signed direct deposit change form through AssureSign, in single- and joint-owner versions, and a downloadable income benefit service form for Zone Income Annuity and ZoneChoice Income Annuity contracts. The general resources block was reorganized — transfer and allocation-change forms consolidated, the claims link moved alongside — and the advisor-resources block pointing producers to their wholesaler was removed.

As with the August 4 forms, these are workarounds rather than restored processing: online account access remains down, and TruStage has not said requests submitted this way will be handled faster than its recovery timetable allows.

A new page on TruStage's outage site gives individual life insurance and AD&D policyholders a way to submit servicing requests while systems are down — their first servicing route of the outage. It carries downloadable PDF forms for changes of ownership, beneficiary changes, and general service requests (billing-frequency changes, withdrawals, loans, cancellation or surrender), with versions depending on whether the policy is issued by CMFG Life or MEMBERS Life and the policy-number prefix. Ownership changes require a completed W-9.

Instructions: print, complete, sign, and mail to the address on the form — fax is not available. TruStage says requests will be processed as systems are restored and honored back to the date received.

It parallels the annuity forms route added August 4, though mail-based rather than e-signed. TruStage did not advance the individual page's timestamp when the forms appeared, so the company has not itself stated a publication date.

TruStage revised its outage-page lead again, re-stamping the dated pages August 5 at 4:48 p.m. CT. The sentence saying the incident had been contained since detection is gone from the lead; the new copy stresses the breadth of the impact across the network and systems and the deliberate rebuilding of infrastructure so services restore safely. On the outage hub, the paragraph stating the incident was contained and no malicious code or bad actor remained was removed altogether.

The containment statement has not been withdrawn — it still stands in the unchanged July 31 press release. It simply no longer appears in the outage-page lead copy.

Separately, the credit-union page joined the rewrite it had sat out for two days: it now calls the event an attack, adopts the same recovery language, adds the mid-August resolution answer, and sharpens its claims guidance to file new claims through the online intake page. That page is still undated, and status across the site still reads Investigating.

TruStage's credit-union outage page now describes how recurring Debt Protection benefit payments are handled while systems are down: a temporary business-continuity process, begun July 29, for credit unions whose members were already approved for recurring payments. Rather than paying individually, TruStage pays a single lump sum generally mirroring what the member received the previous month, adjusted where a benefit has since ended.

Because the lump sum arrives without a member-level ledger, a member of TruStage's claims team will contact each participating credit union directly with the payment detail needed to get the money to the right members. The process starts proactively for credit unions that received six or more recurring member benefit payments the previous month; credit unions below that threshold may ask the claims team to review a member they believe should have been paid.

This is the first time the arrangement has appeared on TruStage's own public page; early-August trade press had described it only as a test with a small number of credit unions.

TruStage revised every dated public outage page and its consumer FAQ on the morning of August 4 — the first substantive rewrite of that language since the incident began. The event is now called a cybersecurity attack rather than an incident throughout, 'identified on July 11' — a date previously given mainly through partner materials and press releases. The opening paragraphs now say TruStage continues to make progress on recovery, that the attack has been contained since detection, and that it is rebuilding portions of its infrastructure and restoring systems in a controlled way.

Most significant for members: a new question on when this will be resolved now appears on the business, retirement, and other outage pages, answering with the mid-August target for the majority of key processes. That target had lived only in the July 31 press release, the CEO video, and emailed partner materials — it is now on the ordinary public pages members are sent to.

The status field still reads Investigating everywhere, and TruStage still calls it premature to draw conclusions about whether any data was accessed.

Alongside the August 4 rewrite, TruStage expanded what annuity contract owners can actually do while systems are down. The annuity outage page now offers electronically signed forms through third-party partner AssureSign for cancelling a pending application, exercising the right to examine, taking a partial withdrawal, and surrendering a contract in full — each in single- and joint-owner versions. A general-resources block adds downloadable transfer and allocation-change forms for the ZoneChoice, Zone, Horizon, and Variable Annuity products, labelled as PDF downloads on TruStage's page. The consumer FAQ also gains a link to a new individual service hub covering claims, annuity resources, and retirement support.

The practical effect: annuity owners who previously had no route to transact now have a forms-based one. Processing still depends on TruStage's restoration — transactions will be handled by the date and time received — and online account access remains unavailable.

TruStage refreshed its dated outage pages on the afternoon of August 3 — the first stamp movement in three days — and the substantive change is on the credit-union page, where the July 23 CEO video has been replaced by a new one. In it, Terrance Williams describes the July 11 event as a broad attack on TruStage's network and systems, says the incident was contained and the company is confirming no malicious code or threat actor remains as it rebuilds, and repeats the mid-August target with the caveat that systems may return before fully normal. He notes refreshed workforce laptops and updated security, names Mandiant as the partner on the data investigation, tells credit unions TruStage still does not know whether member data was accessed — partners will be the first to know — and commits to email updates multiple times a week.

The content matches the July 31 newsroom release; what is new for credit unions is that it now sits on the page they are directed to. The July 23 video's material — including the malicious-file account and the NCUA reporting process — is no longer on the page; it remains recorded in this tracker's July 23 entry.

TruStage published a second incident press release in its newsroom, dated July 31 — the fullest public account it has given. The incident has been contained; the event was broad enough that TruStage rebuilt parts of its infrastructure so systems could be brought back safely rather than simply switched back on, and as it rebuilds it is confirming no malicious code or bad actor remains. Employee laptops have been refreshed and security measures updated, with that work close to complete.

On timing, TruStage states publicly for the first time that it anticipates the majority of its key processes will be operational by mid-August, prioritizing the operations most critical to partners and their members — cautioning that some systems may come back before they are fully operational, with workarounds continuing meanwhile.

On data, it names Mandiant as the outside cybersecurity partner on the investigation, says forensic work takes time, states it does not yet know whether member data was accessed, and commits that if members' personal information is involved it will tell affected partners first and help with any notification or reporting. It also commits to partner email updates multiple times a week.

For credit unions this matters on three counts: the mid-August target is now an on-the-record public statement, the forensic firm is named for the first time, and the containment statement is TruStage's own words.

TruStage published two dated communications documents for credit union partners, both stamped July 31 and hosted on trustage.com: an optional member-and-customer letter template that credit unions may adapt and send, and a talking-points-and-FAQ sheet for staff. Neither carries a confidentiality marking. Their significance: they are the first TruStage-published documents to state a restoration target — 'working toward being operational by mid-August.'

The definition is careful: priority processes and services available through a mix of restored systems, interim processes, and alternative support paths — not every system immediately at full functionality, with temporary workarounds possibly remaining. Until now the target had appeared only in trade-press reporting of a CEO video, and it was still absent from TruStage's public outage pages.

On the recovery, TruStage says it stood up a clean, isolated technology environment segmented from impacted systems, validated by outside cybersecurity experts using secure recovery practices, with restored services passing established validation before production. It describes the event in its own words as a cybersecurity attack that significantly impacted critical technology infrastructure.

The materials summarize progress — claims reporting, expanded phone support including a third-party contact center, lending-related payment processes, certain annuity and retirement processes, recurring disbursements restored — note that platforms with more dependencies may take longer, repeat that conclusions on data are premature, and commit that TruStage will work directly with credit unions and partners if it determines data was compromised.

CU Today reported that TruStage president and CEO Terrance Williams gave credit union partners a new video update saying the company anticipates the majority of its key processes will be operational by mid-August, cautioning that systems coming back online may not be fully operational or fully back to normal. On data, he said the company does not yet know whether member data was accessed, and partners would be the first to know if that changes.

Per the report: customer calls are handled through a third-party contact center, lending capability is in testing with eight credit unions, annuity transactions, death claims, and withdrawals are moving again, and basic billing and claims servicing is expected in the first half of August. The life insurance platform is more complex, spanning several interconnected systems, and broader systems remain offline.

This was the first restoration timeline attributed to TruStage. At capture it appeared on no TruStage public page — the credit union outage page still said no product-specific claim timelines were available — so it is recorded as reported rather than confirmed.

TruStage substantially expanded the FAQ on its credit-union outage page, adding a general outage section and answers written for credit union leaders. The most decision-relevant point: TruStage still cannot say when claims will be paid. 'Product-specific claim payment timelines are not available,' and claims will be evaluated and paid under the applicable policy terms as operational capabilities are restored. Representatives can take inquiries and offer guidance, but some servicing and claims activity remains limited.

It restates: premature to draw conclusions on scope, impact, or data access; grace periods are being extended, with more than one premium possibly coming due; BenefitsForYou is still unavailable; annuity and retirement balances and benefits are unaffected.

New for credit unions planning ahead: the timing and approach for restarting marketing activity, including direct mail scheduled for August, is under evaluation, with lead-fulfillment plans to be communicated separately. The page's question-submission form was replaced with a pointer to the credit union's account representative. The page carries no date stamp of its own; the content appeared between midday and late afternoon on July 31.

TruStage's Retirement Solutions outage page (re-stamped July 30, 4:43 p.m. CT) reverses two answers that previously read as unavailable: payroll files submitted in good order for 360 processing through third-party aggregators — the page names PayKonnect and Payroll Integrations — are now being processed, and previously scheduled installment and annuity distributions are being processed again. Other payroll submissions remain unavailable.

Plan sponsors are no longer told to withhold payroll files; the guidance now says to continue normal payroll operations, including withholding participant deferrals and loan repayments.

Two limits are newly stated: participants and employers who elected electronic benefit statements may see a delay for the quarter ended June 30, and sponsors whose custodian or directed trustee is Matrix Trust Company can log in through Matrix/Broadridge for plan-level statements — an option that does not apply to Choice Group Variable Annuity plans. BenefitsForYou is still offline and participant transactions remain unavailable.

TruStage added two answers to its consumer FAQ and its individual and preplanning outage pages, first seen on the July 30 stamp. Because payment processing is unavailable, it will extend applicable grace periods once processing resumes — and depending on when premiums normally fall due, more than one payment may come due during the extended period. Policies that are active or in a grace period keep that status meanwhile.

Separately, TruStage states it is not currently sending communications requesting premium payments or telling customers a payment is delinquent, and tells anyone receiving such a message not to click links, provide personal information, or submit payment information. That gives credit unions a concrete answer for members who call about a past-due notice during the outage.

TruStage's outage hub now includes a page written for credit unions. Credit insurance, debt protection, and GAP can still be sold, and members are directed to start claims at trustage.com/startclaim.

The interim processes that earlier reached us through a state association are now stated by TruStage itself: eligible PAX credit unions may use the approved GAP workaround, must document every sale made during the outage, and must enter those sales into PAX once service is restored. A limited group of high-volume credit unions may use Assurant's GLOW platform to generate mechanical repair coverage quotes and member pricing and finance the cost into the loan — GLOW explicitly cannot issue contracts, so the official MRC certificate issues only after PAX is back and the sale entered. Selected credit unions receive separate implementation instructions.

For GAP claims and servicing — including a vehicle totaled before a contract could be completed in PAX — the instruction is to keep collecting claim details and supporting documentation. TruStage does not date this page, so the date shown is the date the IT Department captured it.

TruStage's Wealth Management Solutions outage page (stamped July 28) spells out the regulatory mechanics in TruStage's own words: the NCUA is aware of the event, and a credit union that determines the incident is reportable may satisfy that by calling 1-833-CYBERCU (1-833-292-3728) and leaving a voicemail, or emailing cybercu@ncua.gov, giving the credit union's name and referencing the TruStage cybersecurity event.

On whether a credit union must notify its regulators at all, TruStage does not advise: requirements depend on the credit union's own customer relationships, applicable law, and internal policy — consult legal, compliance, and risk teams.

Operationally, the program's financial advisors can serve members through their LPL access and can sell and service every product except TruStage annuities; advisors cannot reach Salesforce for client notes; and an online option is open for annuity partial withdrawals and surrenders, with processing slowed by manual handling. Advisor and credit-union compensation for the first half of July was paid on schedule using an estimate based on the average of the last six pay periods.

TruStage's outage pages for individuals and preplanning coverage (stamped July 28) answer the question front-line staff are most likely to be asked: individual coverage status is not at risk during the outage. A policy that is active or in a grace period stays in that status until regular payment processing resumes, and policyholders can make or update payments once operations are restored.

If someone dies during the disruption, the claim will be processed and paid under the applicable policy terms once TruStage is able; claims start at trustage.com/startclaim. Representatives currently cannot see policy or account information, process transactions, or submit requests.

A dedicated outage line is published: 844-958-8910, weekdays 8:00 a.m.-5:30 p.m. CT and weekends 9:00 a.m.-4:00 p.m. CT, with a warning that waits are longer than usual. Those hours have since been cut twice, and this entry recorded the original pair: Sunday service was off the page by July 31, and the weekday close moved back to 5:00 p.m. CT by August 12. The number held until September 2, when TruStage replaced it on that page with 855-591-9026 and dropped the Saturday hours; see the September 2 entry. At the August 28 check the page publishes weekdays 8:00 a.m.-5:00 p.m. CT and Saturday 9:00 a.m.-4:00 p.m. CT — so a credit union that copied the weekend hours from this entry should correct them. On data, the answer is unchanged: conclusions about scope or impact remain premature.

TruStage's annuity and retirement outage pages (both stamped July 28, 10:43 a.m. CT) carry the most concrete reassurance the company has published so far. On annuities: contract values, account balances, and benefits have not been impacted; transactions will be processed by the date and time received once servicing resumes; and the investigation to date shows no evidence that contract-owner funds, the assets backing annuity obligations, or other company financial accounts saw unauthorized transactions. Owners can submit partial-withdrawal and surrender forms through the company's e-signature partner meanwhile.

On retirement plans: account balances and plan benefits are unaffected, but with BenefitsForYou offline participants cannot view balances, change contributions or investments, trade, update beneficiaries, or request loans and distributions, and the participant service center's phone and email are down. Plan sponsors are told not to submit payroll and contribution files — including through aggregators — but to continue normal payroll operations and withholding, to keep records of processing dates and outage communications, and that Department of Labor guidance allows additional time when the delay is the service provider's outage.

Previously scheduled installments and annuity distributions cannot be processed at present; quarterly statements for the quarter ended June 30 are mailing on the normal schedule. On data, both pages still call conclusions premature.

Credit Union Daily reported that TruStage issued an updated technical FAQ for its business partners. Per the report, TruStage notified law enforcement, engaged the forensic firm Mandiant, made the NCUA aware of the event, and notified applicable regulators. It states it has seen no threat-actor activity since July 11, has identified no known CVEs tied to the compromise, and has not observed the attacker interacting with files shared through third-party systems, portals, VPNs, or APIs connected to TruStage.

It still will not say whether partner or credit union data was accessed or exfiltrated, when access began, how long the intruder remained, what type of attack occurred, or whether anyone claimed responsibility — and it cannot yet give an individual credit union a written attestation about its data. A credit union that determines the event is reportable may notify the NCUA by phone or email, referencing the TruStage event.

The underlying partner FAQ is dated July 20 and marked proprietary and not for distribution, so this entry cites the published report and omits the technical indicators of compromise the document contains. None of these points appeared on TruStage's public pages at capture.

TruStage stood up a central resource hub at trustage.com/outage, dated July 24. It repeats that the company identified a cybersecurity incident affecting its environment, that systems remain down while teams work to establish the facts, and that outside experts and business-continuity plans are engaged.

The hub routes individuals and businesses to service-specific pages, claim filing, and retirement-solutions support, and lists the 1-833-374-1541 support line. It gives no restoration timeline and no finding on data, and continues to call conclusions about scope premature.

TruStage's credit-union outage page carries a recorded update from CEO Terrance Williams, posted July 23. He says TruStage identified unusual activity on July 11 and shut systems down immediately, engaged outside cybersecurity experts, notified law enforcement, and continues notifying regulators. On cause: a member of the workforce may have inadvertently downloaded a malicious file while trying to install a legitimate tool. Investigation and recovery both remain in progress.

He describes restoration as phased and prioritized over days and weeks, with tested workarounds carrying some functions: most credit-insurance and debt-protection products running again, Liberty Mutual and Polly processing auto and home business from direct-mail leads, a GAP-waiver workaround rolling out to credit unions, bond and business-protection renewals supported, and Compliance Solutions cloud products unimpacted. A streamlined NCUA process exists for credit unions that deem the event reportable.

On data, he repeats it is premature to draw conclusions. This material had reached credit unions only through trade press until now; it is significant because TruStage is stating it directly on its own page.

Credit Union Daily reported that TruStage traces the incident to an employee who, per the company, may have inadvertently downloaded a malicious file while attempting to install what looked like a legitimate tool — corroborating CU Today's earlier account.

CEO Terrance Williams described a phased restoration that began the week of July 21, with manual workarounds in the meantime; he was quoted saying the company would not 'sacrifice quality, security or reliability for speed.' The report lists most credit insurance and debt protection products, auto and home processing through Liberty Mutual and Polly, GAP waiver issuance, and bond and business protection renewals as operating, with Compliance Solutions unaffected.

TruStage still called it premature to conclude whether any data was accessed. None of this yet appeared on TruStage's own newsroom or consumer FAQ.

MEMBERS Life Insurance Company, the TruStage subsidiary that issues its Zone and ZoneChoice annuities, filed a prospectus supplement with the Securities and Exchange Commission dated July 21, 2026. It supplements the May 1, 2026 updating summary prospectuses for four products — TruStage ZoneChoice, ZoneChoice Advantage, Zone Income and ZoneChoice Income annuities — and its stated purpose is to notify contract owners that TruStage's systems were unavailable while it investigated the cybersecurity event. The identical supplement was filed under three separate accession numbers, one per registration statement.

The filing sets out what contract owners could not do. It describes a temporary suspension of TruStage's ability to process contract transactions, and lists investment allocation changes, cash withdrawals, surrenders, systematic withdrawals, beneficiary changes, death claim payments, dollar cost averaging and rebalancing. It notes that the disruption to online and telephone service also affected TruStage's ability to receive requests in the first place. As an interim path it directed withdrawal and surrender requests by mail to MEMBERS Life at 2000 Heritage Way, Waverly, Iowa, and cautioned that payments could be delayed by manual processing.

The most durable commitment in the filing is on timing. TruStage said pending transactions received in good order would be processed once transaction processing resumed, with systematic withdrawals, cash withdrawals and surrenders taking priority, and that it would process those requests as if they had been handled on the dates it received them. That is the same effective-dating promise its public annuity page now makes, and it is the commitment against which this week's news that outstanding monthly systematic withdrawals have been processed should be read.

Two record-keeping notes. This was the first SEC filing we found that discusses the incident, and the tracker's earlier entry recording that none had appeared was corrected then. A full EDGAR sweep on August 18 has since found an earlier one: a July 20 supplement for a separate set of variable annuities, logged separately, so the earliest SEC disclosure is July 20 rather than July 21. And the supplement dates the shutdown differently from TruStage's public pages: it says TruStage proactively shut down many of its systems on July 10, while the outage pages and consumer FAQ date the identification of the attack to July 11. Both dates are recorded here as each source states them; nothing published resolves the difference.

CU Today reported that TruStage has entered recovery, bringing systems back in a controlled, prioritized sequence expected to span days and weeks. Most credit-insurance and debt-protection products are operating again, with temporary manual workarounds supporting some claims, GAP waivers, and bond and business-protection renewals; cloud-based Compliance Solutions were unaffected.

Investigators reportedly believe the incident began when an employee inadvertently downloaded a malicious file while installing what appeared to be a legitimate tool; TruStage detected unusual network activity on July 11 and shut systems down to contain it. CEO Terrance Williams was quoted saying the company would 'be methodical.'

TruStage still calls it premature to say whether any data was accessed, and says it is coordinating with outside experts, law enforcement, and regulators, including a streamlined NCUA reporting path. Separately, American Banker reported no ransom demand and no threat-actor activity since discovery. These details came from trade press and were not yet on TruStage's own pages.

MEMBERS Life Insurance Company, the TruStage subsidiary that issues annuity contracts, filed prospectus supplements with the SEC on July 20-21 (Forms 497/497VPU) disclosing that the incident has disrupted its operations.

The filings say the company temporarily cannot process a range of contract transactions — cash withdrawals, surrenders, systematic withdrawals, beneficiary changes, death-claim payments — and cannot issue new contracts while systems are restored; interim mail-in arrangements cover certain requests.

The filings do not state that any non-public personal information was accessed, and no restoration date is given. Members holding TruStage annuities may see delays in these transactions.

MEMBERS Horizon Variable Separate Account, a MEMBERS Life Insurance Company separate account, filed a Form 497 prospectus supplement dated July 20, 2026. It supplements three statutory prospectuses dated May 1, 2026 — the MEMBERS Zone Annuity, the MEMBERS Horizon Variable Annuity and the TruStage Horizon II Annuity — and the filing states its own purpose plainly: to notify contract owners that TruStage systems were unavailable while it investigated a cybersecurity event.

The substance matches the July 21 supplement this tracker already records. It describes a temporary suspension of TruStage's ability to process contract transactions, listing investment allocation changes, cash withdrawals, surrenders, systematic withdrawals, beneficiary changes, death claim payments, dollar cost averaging and rebalancing, and notes that the disruption to online and telephone service also affected TruStage's ability to receive requests at all. It routes withdrawal and surrender requests by mail to Waverly, Iowa, warns that manual processing may delay payments, and makes the same effective-dating commitment: pending transactions received in good order after July 10 would be processed once processing resumed, as if handled on the dates received, with systematic withdrawals, cash withdrawals and surrenders given priority.

Two corrections to the record follow. First, the earliest SEC disclosure of this incident is July 20, not July 21; the tracker's July 21 entry said it was the first filing found, and that sentence has been corrected. MEMBERS Life filed seven Form 497s of its own the same day, before the larger July 21 batch. Second, the product scope is wider than recorded. The previously tracked filings covered the index-linked ZoneChoice family; these cover variable annuities, a distinct set of contract owners who were not represented in the tracker's account of which TruStage products the outage reached.

This came out of a full EDGAR sweep of all form types from July 10 through August 18, which returned 68 keyword hits. Every hit outside this July 20–21 cluster matches a noise class already documented in the research routine — fund portfolio holdings of TruStage debt, an insurance-carrier risk factor, private note purchase agreements signed by TruStage's investment arm, and two effectiveness-delay filings that name nothing. No 8-K exists and none should be expected: TruStage Financial Group is not an SEC-reporting equity issuer, so these insurance-product supplements are the only channel through which the incident reaches EDGAR. This filing also dates the proactive shutdown to July 10, against the July 11 identification date on TruStage's outage pages — the same unresolved discrepancy already noted on this page.

TruStage refreshed the status line on its consumer FAQ to July 19, 2026, 11:15 a.m. CT. The substance did not change: systems remain shut down while the company works to restore them, customers may still have trouble reaching accounts or completing transactions online, and TruStage says it is premature to draw conclusions about the scope or impact of the incident. No restoration date and no data-exposure finding were given.

In an update posted to its newsroom, TruStage said it had activated its incident response and recovery protocols and engaged outside cybersecurity experts. With its systems still down, the company directed customers to newly launched resources: a consumer FAQ, an online page to start a claim, and a support line at 1-833-374-1541.

TruStage's consumer FAQ (marked last updated July 16) describes the situation as under investigation, with systems proactively shut down while restoration continues. Customers may have difficulty accessing account information, completing transactions, or submitting requests online; delayed 401(k) access and how to file claims are specifically addressed.

TruStage said it would be 'premature to draw conclusions about the scope or impact' of the incident, including whether any data was accessed.

TruStage opened an online form for consumers to begin a claim while systems are down, covering protected-loan, death-or-dismemberment, and business-protection claim types, and says it will follow up as soon as possible. Rather than collecting sensitive details, the form asks members to choose a relationship and a preferred contact time, and cautions users not to include policy, contract, account, or Social Security numbers.

TruStage Compliance Solutions posted a notice on its community portal saying it was aware of the cybersecurity issue TruStage had announced, and that its own cloud products were not affected. Clients were told they could keep using those applications as usual, and the notice repeated that the outage did not originate in Compliance Solutions technology. The notice did not address the cause or scope of the wider TruStage incident.

TruStage disclosed that it had detected a cybersecurity incident affecting its environment and immediately activated its incident-response and recovery procedures. The company said it engaged outside cybersecurity experts to assist with containment, remediation, and recovery, and that the work remained ongoing. It said it was still establishing the facts and did not indicate whether any data had been accessed or name specific affected systems.

Credit Union Daily reported that TruStage had voluntarily shut down portions of its network after detecting suspicious activity, triggering its incident-response protocols alongside third-party specialists. The outlet emphasized that TruStage had not indicated whether ransomware was involved or whether any customer or employee information had been accessed.

Coverager highlighted the downstream effect on a partner institution: First Commonwealth Federal Credit Union told members that TruStage was temporarily unavailable for GAP, mechanical repair coverage, and payment protection claims. The report noted the disruption was confined to TruStage products offered through the credit union and did not affect the credit union's own deposits, cards, ATMs, or online banking.

TruStage Compliance Solutions reported that Service Desk access was fully restored as of 3:20 p.m. ET on July 14, two days after the outage that began the morning of July 12. The team said it could again view and process the support tickets submitted while access was unavailable, and that those tickets would be worked in the order received. The notice did not say what caused the outage or whether it was related to the broader TruStage incident disclosed the following day.

A notice on TruStage Compliance Solutions' community portal reported that as of 8:30 AM ET on July 12 a systems outage was preventing its team from accessing the Service Desk, delaying responses to support tickets. The notice said the outage was not related to Compliance Solutions technology and directed clients and partners to email support addresses instead. TruStage has not publicly said whether this outage is connected to the broader incident it disclosed on July 15.