TruStage is still restoring its systems after a cyberattack it identified on July 11, and many services credit unions rely on are only partially available.
It has not said whether any member or credit union data was accessed; its review continues, and TruStage says it will notify anyone affected directly if customer information is found to have been accessed. TruStage has published no date for finishing claims or completing its recovery, and it says some requests may take longer than normal. The disruption is to TruStage products, not your credit union's own deposits, cards, ATMs, or online banking.
Statuses reflect TruStage’s most recent public updates.
TruStage's three dashboards — claims, policy and contract servicing, disbursements — say where each product stands function by function. They carry no date stamp, so check them fresh and read the note under each product, not just the label.
TruStage has published an optional member letter template and a talking points and FAQ sheet for staff, both dated July 31. Adapt them, but run them through your own review and approval process first.
TruStage publishes no date for finishing claims, and since October 14 it publishes no claims figures on any surface we track. Keep collecting claim details and supporting documentation, and record every member inquiry so it can be followed up until the claim is actually paid.
Send members to trustage.com/outage/individual or the number that page now publishes, 1-800-779-5433 (weekdays 8 a.m. to 5 p.m. CT; TruStage dropped its Saturday hours on October 8), not to secondhand reports. TruStage swapped it in on September 15, replacing 855-591-9026, which had itself replaced 844-958-8910 on September 2 — correct both anywhere you posted them.
This is a disruption at TruStage, not at your credit union. Deposits, cards, ATMs, and online banking are unaffected, and TruStage says annuity and retirement balances are too. A policy that is active or in a grace period stays that way until payment processing resumes.
Scams may reference the outage. TruStage says it is resuming mailed AD&D paper bills in the last week of October, so a paper AD&D bill may be genuine. TruStage will not ask members for passwords or account credentials by email or text.
“Is my money safe?”
Yes. This is an issue at TruStage, an insurance partner — not at the credit union. Deposits, cards, ATMs, and online banking are unaffected.
“When will TruStage services be back to normal?”
TruStage gives no public date for overall recovery or for finishing claims, and since October 6 it publishes no forward-looking timing at all; it dropped its window for more annuity servicing to return across September and October. It describes recovery as phased, says many critical capabilities are already restored, and says remaining work, including claims backlogs and some servicing functions, will take additional time.
“Will my coverage lapse if I can't pay right now?”
No. TruStage says a policy that is active or in a grace period stays in that status until normal payment processing resumes, and that it will extend applicable grace periods once it does.
“I got a notice saying my TruStage payment is past due.”
Check what it is. TruStage says it is resuming paper bills for AD&D customers not on automatic payments in the last week of October, so a mailed AD&D bill may be real: pay it by check or money order with your policy number on it, using the addresses at trustage.com/outage/individual/payments. Its preneed page says it is not sending notices telling Preplanning customers they are delinquent and about to lose coverage, and that no one will lose coverage for being unable to pay during the disruption. Do not click links, give out personal information, or submit payment details in response to an email, text or call — and let us know so we can flag it.
“What about my annuity or retirement account?”
TruStage says balances and benefits are not affected, though you may not be able to view or transact on the account yet. It also says it has found no evidence of unauthorized transactions on contract-owner funds.
“Was my personal information exposed?”
TruStage has not reported that any data was accessed. Its outage pages say the investigation with outside experts is continuing, and all seven now add that if customer information is found to have been accessed, TruStage will notify each affected person directly with next steps; the retirement page was the last to take that answer, on October 13. Rely on official TruStage notices, not rumors.
“What about my TruStage claim?”
Claims may still be delayed, and TruStage no longer publishes a date for finishing them. You can start a claim at connect.trustage.com/startclaim or call the number on TruStage's individual outage page, 1-800-779-5433 (weekdays 8 a.m. to 5 p.m. CT; no Saturday hours since October 8). We are logging inquiries for follow-up.
“I got an email or text about the outage.”
Be cautious — scammers may reference this incident. TruStage will not ask for passwords or account credentials by email or text.
TruStage — formerly CUNA Mutual Group — provides insurance and financial-services products that many credit unions offer their members. On its own outage pages the company says it identified unusual network activity on July 11, 2026 and shut its systems down to investigate, disclosing the incident publicly on July 15. It has since begun a phased restoration, and says the likely cause was an employee inadvertently downloading a malicious file while trying to install a legitimate tool.
A disruption to TruStage products does not affect your credit union's own deposits, cards, ATMs, or online banking. For most credit unions the immediate effect is a service disruption, not a confirmed data breach.
TruStage says systems are coming back in a controlled, prioritized sequence over days and weeks, not all at once, with some functions running on tested workarounds in the meantime. Since August 20 it publishes a dashboard showing where each product stands, but no date for finishing claims or completing recovery, and since October 6 no forward-looking timing at all.
TruStage has not said whether any member or credit union information was accessed, or whether ransomware was involved — it says its cybersecurity partner Mandiant and its internal teams are still working that out. Treat anything beyond TruStage's own statements as unconfirmed.
If your credit union relies on TruStage products, make sure staff know which services are affected, what interim processes exist, and where to direct member questions. We will keep this page current as TruStage and reputable outlets report.
TruStage says it identified unusual activity on its network on July 11, 2026 and immediately shut its systems down to investigate; its first public statement came July 15. A July 21 SEC prospectus supplement from its MEMBERS Life subsidiary instead dates the proactive shutdown of many systems to July 10; the difference between the two dates has not been addressed publicly.
TruStage says the likely cause was a member of its workforce inadvertently downloading a malicious file while trying to install a legitimate tool. The investigation is still open.
TruStage says the incident has been contained. Because the event was broad, it rebuilt parts of its infrastructure rather than simply switching systems back on, standing up a clean, isolated technology environment segmented from systems that were impacted, potentially impacted, or still under investigation. It says outside cybersecurity experts validated that environment using secure recovery practices, restored services pass established validation before entering production workflows, and as it rebuilds it is confirming no malicious code or bad actor remains in its systems or network.
TruStage's public outage pages and consumer FAQ describe the event as a cybersecurity attack identified on July 11, rather than as a cybersecurity incident. On August 5 the opening paragraph was rewritten again: it stressed the breadth of the impact across the company's network and systems and the rebuilding of portions of its infrastructure, and the sentence saying the attack had been contained after detection was dropped from that lead and removed from the outage hub. The containment statement was never withdrawn — it still stands in TruStage's July 31 press release — and on September 22 it returned to outage-page lead copy: the rewritten individual outage page now opens by saying that since the attack was detected TruStage has contained the incident. As of September 22 that page is the only outage page whose lead says so; elsewhere "contained" appears only inside the question of the cybersecurity-expert FAQ. On October 27 the cybersecurity-expert answers on the credit union, annuity and preneed outage pages began attributing to Mandiant the finding that the incident is contained and the operating environment clean, citing its October 9 memo. The business, wealth management and retirement pages followed later that day, so all six outage pages that carry the question now give that answer; the individual page carries no Mandiant answer.
TruStage names Mandiant as the outside cybersecurity partner working with its internal teams on the data investigation, and since September 9 its credit-union outage page also names Epiq Global on the data-analysis side — the first TruStage-owned page to do so, though the company named the firm in its August 12 partner update; the preplanning outage page became the second on September 15. TruStage says it notified law enforcement and continues to notify regulatory authorities as appropriate. It says it does not yet know whether member data was accessed; if it determines data was compromised it will work directly with credit unions and other partners, notifying affected credit unions first — before any communication with their members — and supporting them through any notification or reporting process.
The NCUA is aware of the event. A credit union that determines the incident is reportable may report by calling 1-833-CYBERCU (1-833-292-3728) or emailing cybercu@ncua.gov, naming the credit union and referencing the TruStage cybersecurity event.
Restoration is running in a phased, prioritized sequence, and TruStage said it was working toward being operational by mid-August, prioritizing the operations most critical to partners and their members. It defined that as priority processes and services being available through a mix of restored systems, interim processes, and alternative support paths — not every system immediately at full functionality, with temporary workarounds possibly remaining in place. The target appeared in partner materials dated July 31 and was stated publicly — in a July 31 newsroom press release, in a CEO video on the credit union outage page, and, as of August 4–5, on its public outage pages. TruStage then removed it page by page: the consumer and retirement pages on August 18, the credit-union page on the morning of August 19, the business page later that morning, and the rest over the days that followed. The wealth-management page was the last to carry it as a live FAQ answer, and TruStage replaced that answer on the afternoon of August 27 with the same undated, phased-recovery wording used elsewhere. The target was never withdrawn as a commitment and no new date replaced it — it was edited out. As of the August 27 afternoon check the phrase survived only in dated, historical material: the July 31 and August 13 newsroom releases, which remain posted as records, and the CEO video transcript carried on the credit-union page. TruStage removed that video and its transcript from the credit-union page between the 4:02 p.m. and 6:42 p.m. checks on September 3, so the target now survives only in the two newsroom releases. CrossState's resource page no longer carries it. The one piece of forward-looking timing it published after that was narrower and newer — dated update blocks added on September 4 saying it expected to complete payment of most life and AD&D claims submitted before July 11 by mid-September — and it deleted that on September 11, along with the undated wording its claims dashboard had carried since August 28. TruStage now publishes no completion date for any system, product or claim. Until October 6 the only forward-looking timing on its surfaces was a window, not a date: its servicing dashboard said additional annuity servicing and advisor-support capabilities would continue to return across September and October, and its disbursements dashboard said recovery efforts planned through those months were expected to expand support. Both dashboards dropped the window on October 6 and named phased issuance of delayed annuity contracts instead, with no date. On October 27 the servicing dashboard reworded that line to cover contracts for applications received before and during the outage, still undated, and the disbursements dashboard dropped it.
As of July 31 TruStage said it could not give product-specific claim payment timelines, and that claims would be evaluated and paid under the applicable policy terms as operational capabilities were restored, with representatives able to take inquiries while some servicing and claims activities remained limited. Its August 13 release — carried onto the credit-union and consumer pages on August 19 — said it had started paying claims across preplanning and funeral, GAP, and debt protection and credit insurance, while core life and AD&D processing was still being restored, with claims pending at the time of the outage worked before claims received afterward. That changed on the afternoon of August 28, when its claims dashboard published its first product-level timing: it expects most pre-outage life claims and most pre-outage AD&D claims to be paid by the end of next week, with the remainder requiring additional documentation, and says review of GAP claims submitted after July 11 has begun. The dashboard carries no date stamp, so “next week” is relative to a publication date TruStage does not print; read on the afternoon of August 28 it points at the week beginning August 31. It is an expectation about most claims, not a report that they have been paid, and no availability label moved with it — submission, processing and payout remain partially available for all three lines. TruStage restated the expectation on September 4, in dated update blocks added to its outage hub and its credit union outage page, saying it expected to complete payment of most life and AD&D claims submitted before July 11, 2026, by mid-September — later than the week the August 28 wording had pointed at. On September 11 it deleted both. The mid-September sentence came off the hub and the credit union page, the older sentence came off the claims dashboard, and nothing dated replaced either. In their place TruStage publishes totals: more than $44 million in pre-outage life and AD&D claims paid, with teams still working the remainder including claims that need additional documentation, and more than $6.6 million in recent credit insurance and debt protection life payments, which it says accounts for all outstanding pre-outage debt protection life and credit life claims. Those are the first dollar figures TruStage has published on its own outage surfaces. The dashboard's earlier line about review of GAP claims filed after July 11 was removed in the same edit, replaced on the hub by a general statement that review of post-July 11 claims continues as capacity expands. No availability label moved with any of it; submission, processing and payout remain partially available for life, AD&D and payment protection. On the evening of September 15 TruStage published a second set of totals, on its consumer FAQ and nowhere else: over $60 million in Individual Life claims and more than $44 million in lending and property-and-casualty claims paid since the attack. These are the first appearance of either category on a TruStage-owned surface — CrossState had relayed smaller versions of both, $36 million and $33 million, on September 9 — and they do not reconcile with the dashboard figure: $44 million now names lending and property-and-casualty on the consumer FAQ and pre-outage life and AD&D on the hub, the credit union page and the claims dashboard, which all still carried that wording at the time. The same edit returned the sentence saying review of GAP claims submitted after July 11 has begun — deleted from the claims dashboard on September 11 and still absent there — to the consumer FAQ alone, and dropped from that page the statement that pre-outage life and AD&D claims are worked before claims received afterward, which the credit union outage page kept until October 15. No completion date returned with any of it. On the afternoon of September 18 TruStage rewrote all three surfaces again and restamped the hub and the credit union page “Latest update – Sept. 18.” The $44 million pre-outage life and AD&D total is gone, replaced by more than 10,000 life and AD&D claims paid representing more than $100 million in benefits delivered — wording that carries no pre-outage qualifier, so it is not a like-for-like increase on the figure it replaces, and TruStage does not say what population or period it covers. The same edit removed the $6.6 million credit insurance and debt protection life figure and the sentence saying those payments accounted for 100 percent of outstanding pre-outage debt protection life and credit life claims; neither survives on any TruStage surface we track, and nothing published says that completion no longer stands. In their place, in that afternoon edit, the hub and the credit union page said all pre-outage GAP claims have been processed except those awaiting required information and that recurring disability and unemployment claim backlogs have been cleared, and the claims dashboard's payment protection section adds the first post-outage percentages of the incident: approximately 20 percent of claims submitted after July 11 processed, with the member or credit union contacted to gather information on an additional 50 percent of that inventory. The life and AD&D sections of the dashboard dropped their dollar figures entirely and now say only that teams continue working through pre-outage and post-outage claims. The consumer FAQ's September 15 totals were not touched. No claims availability label moved, and no completion date returned.
TruStage edited all of it again that same evening. The hub bullet was cut back to more than 10,000 life, AD&D and pre-planning claims paid — the $100 million figure gone, the claim category wider, and the backlogs sentence dropped — while the credit union page kept the fuller wording it had published hours earlier, so the two pages no longer agree and TruStage does not say which is current. The claims dashboard dropped its own backlogs sentence in the same edit and re-scoped its percentages, which now read approximately 20 percent of post-outage claims processed with the member or credit union contacted to gather information on an additional 50 percent. Both pages also dropped the sentence, added earlier the same day, saying death claims support is now available as part of retirement and annuity servicing; the underlying capability statements on the annuity outage page and on both dashboards were left in place.
By the morning of September 19 both of those figures were gone as well. Between the 6:01 p.m. sweep on September 18 and the 6:45 a.m. sweep on September 19 TruStage deleted the claims-count bullet from the credit union page as it had from the hub the evening before, taking the $100 million figure with it, and removed the credit union page's clause about recurring disability and unemployment claim backlogs being cleared. Neither page's “Latest update – Sept. 18” stamp moved. What remains in the claims block on both is the single sentence that all pre-outage GAP claims have been processed except those awaiting required information, so no claims count or dollar total appears on either summary page. That left as TruStage's only published figures the consumer FAQ's September 15 totals, untouched, and the claims dashboard's payment protection percentages. The same overnight edit trimmed the policy and contract servicing block on both pages, removing the sentence enumerating available support and the sentence saying some servicing requests still require interim or manual processes; both statements remain on the policy servicing and disbursements dashboards, so that detail moved rather than being withdrawn.
On September 25 TruStage restamped the hub and the credit union page “Latest update – Sept. 25” and removed the GAP sentence from both, so their claims blocks now carry no claims statement at all, only a note about enhanced online support resources; the sentence survived on the claims dashboard until October 6. The same edit took the payment protection percentages off the claims dashboard — approximately 20 percent of post-outage claims processed and an additional 50 percent contacted for information — and replaced them with a statement that TruStage has begun contacting the member or credit union to gather information on post-outage claims. No figure replaced them, no availability label moved, and no completion date returned.
On the afternoon of October 14 TruStage removed the last of them. Between our 4:04 p.m. and 6:05 p.m. Eastern checks it deleted the consumer FAQ's September 15 totals — over $60 million in Individual Life claims and more than $44 million in lending and property-and-casualty claims — and the clause saying review of GAP claims submitted after July 11 had begun, with no explanation, no replacement figure, and no move in the page's “Last Updated” stamp. Since then no TruStage surface we track carries a claims count or dollar total. The FAQ still says product-specific claim payment timelines are not available and that claim payments have resumed for preplanning and funeral, GAP, and debt protection and credit insurance.
On the morning of October 15 the credit union outage page deleted both its list of claim types TruStage has started paying and its statement that pre-outage life and AD&D claims are worked before claims received afterward. That ordering now appears on no TruStage outage page or dashboard we track, only in the August 13 newsroom release; the credit union page says instead that claims are generally worked in the order received and paid once all required information is in.
Most credit-insurance and debt-protection products are running again; auto and home new business is processing through Liberty Mutual and Polly; bond and business-protection renewals are supported. Interim processes are published for credit unions: eligible PAX credit unions may use the approved GAP waiver workaround, and a limited group may quote mechanical repair coverage through Assurant's GLOW platform — quoting only, with contracts and certificates issuing after PAX is restored and the sale entered. On TruStage's claims dashboard, payment protection claims — credit insurance, debt protection, and GAP — are partially available at every step from submission to payout and are being accepted, processed, and paid, while mechanical repair coverage claims remain fully available through Assurant's normal claims process. Since October 26 the dashboard also lists annuity death claims as available from submission to payout, supported by interim processes; payout had read unavailable since at least August 20. Credit unions are told to keep collecting claim details and supporting documentation. As of August 19 TruStage qualifies the business-protection picture: the Required Renewal Questionnaire is unavailable, with additional time to be given and credit unions to be notified once it returns, and all Business Protection policy servicing requests — certificates of insurance, vehicle and location changes — are to be emailed to BusinessProtection@trustage.com.
TruStage says annuity contract values, balances, and benefits are unaffected, and that it has found no evidence of unauthorized transactions on contract-owner funds, the assets backing its annuity obligations, or other company financial accounts.
TruStage says individual coverage will not lapse during the outage: a policy that is active or in a grace period stays in that status until payment processing resumes. As of July 30 it also says it will extend applicable grace periods once processing resumes, and that more than one premium payment may then come due depending on the policy's normal payment schedule. It began naming coverages on August 18 — Life, Accidental Death and Dismemberment, and Preplanning — and on August 19 a second answer on the consumer FAQ extended the list to Life, AD&D, Preneed and Payment Guard Advantage, the first lending product to appear in the promise. TruStage deleted that second answer on October 26, so no TruStage page we track now names Payment Guard Advantage in the promise; the consumer FAQ and the preneed outage page name Life, AD&D and Preplanning. Separately, it says it is still evaluating how premiums missed during the disruption will be handled and will contact affected customers directly about any action required.
Retirement plan balances and benefits are unaffected, and BenefitsForYou.com, which from September 16 opened a TruStage retirement continuity site at info.benefitsforyou.com, again showed the BenefitsForYou website on the evening of October 6, with participant log-in and registration buttons; its financial professional portal says that service is not currently available. On October 6 TruStage’s policy-servicing and disbursements dashboards began saying BenefitsForYou online access is returning through a phased approach; on October 13 both changed that to say access has returned in phases, and its outage hub and credit union page added that BenefitsForYou digital access has returned for many retirement participants. On October 14 the consumer FAQ and the individual outage page took the same phased-access wording. On October 20 both dashboards added that plan sponsors, advisors and third-party administrators are also gaining visibility into defined contribution participant balances. Participants who previously set up an online account may be able to view retirement account information, and the disbursements dashboard still says they must reset their password first. Balances shown reflect current values as of the most recently processed cycle date and may not yet include recent payroll contributions, earnings adjustments or transactions still being processed. Neither dashboard gives a sign-in address or mentions the log-in page, but as of October 8 the continuity site, still online, tells existing users to log into BenefitsForYou.com and reset their password, says participants who never created an account will get access in a later phase, and still says TruStage is working to restore full BenefitsForYou.com access. Participants in most defined contribution plans — 401(k), 403(b), governmental 457(b) and tax-exempt 457(b) — request a distribution or loan by calling the Participant Service Center at 800-999-8786 for the correct form, returning the completed form to the plan sponsor or third-party administrator for approval, and having it uploaded through TruStage’s secure portal; the same number, or participantservicecenter@benefitsforyou.com, answers questions about which plans the process covers. Its investment trade and allocation change request process, first named on September 4, lets participants in those same Matrix-recordkept plans change elections, with previously scheduled rebalancing continuing as scheduled; the plan-specific form comes from its Education Services Center, and TruStage says the process may not cover every plan. That is the first investment-transaction route TruStage has named since it removed the answer listing those functions as unavailable on August 18. Payroll guidance now splits by plan type: files arriving through an automated payroll-provider or aggregator integration (TruStage names PayKonnect and Payroll Integrations) keep processing, employers who upload files themselves were emailed an interim secure-portal process on August 19, and plans using the Choice Group Variable Annuity cannot have payroll files processed at all, though TruStage will hold their deposits in a non-interest-bearing account. Sponsors are told to continue normal payroll operations, to keep enrolling newly eligible employees, and to document any outage-related delay; TruStage says contributions are processed as of the payroll check date. Since October 8 it adds that payrolls generally process in check-date order, and that a file going straight through follows the plan's current configuration, forfeitures included, which sponsors must contact TruStage to change before submitting, because a file cannot be stopped once processing starts. Previously scheduled installment and annuity distributions are being processed. On September 22 TruStage cut this detail from its retirement outage page altogether, leaving a status summary that points to the continuity site; every removed block was already published there. Beneficiary election updates were on the removed unavailable list and TruStage has not said they have returned. The continuity site adds guidance published on no other TruStage surface: monthly mailed statements for Matrix-recordkept plans beginning with the 8/31/2026 month-end, and, for defined benefit and pension plans, payments established before July 2026 continuing while TruStage cannot process new benefit calculations or payment requests.
As of August 4, annuity contract owners can submit application cancellation, right to examine, partial withdrawal, and surrender requests through electronically signed forms on TruStage's annuity outage page, handled through its partner AssureSign, with downloadable transfer and allocation-change forms also posted. Online account access remains unavailable and processing still depends on restoration.
TruStage says that on July 29 it began a temporary business continuity process for credit unions whose members were already approved for recurring Debt Protection benefit payments. It says those payments are being issued as a single lump sum generally reflecting the prior month's recurring payments, adjusted where a benefit has ended, and that because the lump sum carries no member-level ledger its claims team will contact participating credit unions directly with the payment detail. TruStage says it is starting the process proactively for credit unions that received six or more recurring member benefit payments in the previous month, and that credit unions below that threshold may ask the claims team to review an individual member. On August 19 TruStage replaced that description on its credit-union page. The lump-sum mechanics, the absence of a member-level ledger and the six-or-more threshold are no longer published; the page now says only that payments are being prioritized for credit unions with the highest volume of approved recurring benefits and will expand as recovery progresses, and tells credit unions with questions about a specific member to contact the claims team.
TruStage resumed recurring ACH premium payments for certain customers starting August 4 and initiated recurring credit card drafts on August 20, saying no customers were double-billed to recover a payment missed during the outage. As of the August 27 check its outage pages still describe paper billing and one-time payments as not yet available — though its policy-servicing dashboard marks one-time payments partially available for Life and AD&D and available for annuities — and representatives still cannot verify an individual customer's payment activity while account access remains limited. On September 4 TruStage restated the recurring restarts on its outage hub and credit union page and narrowed the description: recurring ACH and certain recurring credit card payments have resumed for eligible life and AD&D customers using payment details already on file. On October 8 two payment answers on TruStage's individual outage page began saying recurring ACH and card payments have resumed for most customers, rather than beginning to resume for some eligible ones. At our 4:38 p.m. check that day, a billing answer higher on the same page still described the restart as covering certain Life, AD&D and Preplanning customers, and the preneed page and the Canadian FAQ kept the beginning-to-resume wording. On October 27 TruStage rewrote the billing answers on its individual and credit union outage pages: both now say it previously resumed recurring ACH and card payments for AD&D and Life policies, without the August dates or the most-customers wording, and that it is resuming AD&D paper bill mailings in the last week of October; one-time payments online or by phone remain unavailable. The same edit dropped the individual page's statement that representatives cannot verify payment activity, and the credit union page now says representatives have access to additional billing history. Later that day the preneed page's billing answer moved too: it says recurring ACH and card payments previously resumed for certain Life, AD&D and Preplanning customers, that AD&D paper bills have resumed, and that TruStage is preparing to resume paper bills for some Preplanning policies.
Until October 26 TruStage's consumer FAQ and outage pages said it was not sending communications requesting premium payments or telling customers a policy payment was delinquent, and told anyone who received one not to click links, share personal information, or submit payment information. The consumer FAQ dropped that answer on October 26, and the individual and credit union outage pages dropped it on October 27, when both began saying TruStage is resuming AD&D paper bill mailings in the last week of October for customers not on recurring ACH or card payments. The preneed outage page kept it until later on October 27, when TruStage narrowed it there to say only that it is not sending notices telling customers a Preplanning payment is delinquent and coverage is about to end; the same answer says TruStage is preparing to resume paper bill mailings for some Preplanning policies, with no date, and that no one will lose coverage for being unable to pay during the disruption. A mailed AD&D bill may therefore be genuine; TruStage says to pay it by check or money order with the policy number written on it, and notes that some sections of the bill describe automatic-payment and online options that are not yet restored.
TruStage has published materials credit unions may adapt for member communication: an optional member and customer letter template and a talking points and FAQ sheet for staff, both dated July 31, 2026.
TruStage rewrote this answer beginning August 26 and by August 31 every tracked US surface carried it: the annuity and business outage pages first, then the credit-union, preneed, individual, wealth-management and retirement pages, and finally its consumer FAQ. It says the forensic and data-impact analysis with outside cybersecurity experts is continuing, that determining whether any information was accessed and understanding the scope requires extensive investigation and validation, and that the analysis is expected to take additional time.
TruStage Life of Canada's FAQ on trustage.ca still carries the earlier wording, which frames conclusions as premature and says TruStage does not want to get ahead of the facts, with the forensic and data-impact paragraph appended. TruStage took the FAQ down on October 27 and restored it unchanged on October 28.
On October 7 TruStage began replacing the answer again, on the same two pages it started with in August: its business and annuity outage pages now drop the statement that the analysis will take additional time and say that if customer information is found to have been accessed, TruStage will notify each affected person directly with next steps. The wealth management, credit-union, individual and preneed pages followed on October 8, and the retirement page on October 13, between our 4:04 p.m. and 9:45 p.m. checks. At the 9:45 p.m. check on October 13, all seven outage pages carried the new answer; the consumer FAQ and the Canadian FAQ still carried the earlier one.
TruStage withdrew its mid-August target from its outage pages without setting a new one, and on September 11 it withdrew its claims-payment expectations too: the mid-September date from the outage hub and credit union page, and the older undated wording from the claims dashboard. Its per-product dashboards carry no date stamps. What it publishes instead is progress, including its first dollar totals for claims paid.
TruStage's annuity outage page now warns that TruStage will never ask anyone to send money to a third party, and says not to act on an unexpected payment request but to verify it at 800-798-5500. No other tracked TruStage page carries the warning.
Between our 10:04 a.m. and 12:04 p.m. Eastern checks on October 29, TruStage added a fraud notice to its annuity outage page, directly below its recovery statement. It says TruStage will never ask anyone to send money to a third party, and that anyone who receives an unexpected payment request claiming to come from TruStage should not act on it and should call TruStage at 800-798-5500, the annuity contact center number, to verify the request. The notice appears on no other TruStage page we track.
The same edit shortened the page's “We're here for you” section. It no longer lists the limited set of tasks representatives could help with while restoration continues (confirming the status of withdrawals and surrenders, providing contract values, and helping with the page's forms), and it now describes the Annuity Contact Center as open rather than newly opened. The hours, weekdays 8 a.m. to 5 p.m. CT, and the number did not change. TruStage did not say on this page whether representatives can now help with more; its policy-servicing dashboard has listed a wider set of annuity requests the center handles, from direct-deposit changes to withdrawals, surrenders and death claims, since October 27.
This is a different warning from the one TruStage dropped from its consumer FAQ and its individual and credit union outage pages on October 26 and 27, which said it was not sending payment requests or past-due notices at all. The annuity page's shared “Last Updated” stamp did not move with this edit; it still read October 29, 8:23 a.m. CT at this check.
TruStage's outage page for individuals now says life policyholders can cancel by phone and sign electronically, or still mail the form; AD&D cancellations still require the form. Its dashboards have described the phone route since October 27.
Between our 8:22 a.m. and 10:04 a.m. Eastern checks on October 29, TruStage rewrote the answer on its individual outage page about cancelling or changing a Life or AD&D policy. It now says a Life policyholder who wants to cancel can call TruStage and complete the cancellation by e-signature, or can still submit the appropriate form from the Life and AD&D service forms page, and that an AD&D policy can be cancelled only by submitting the form. The rest of the answer did not change: TruStage will process requests and honor them by the date received as servicing returns, and will take customers who ask to cancel or surrender off recurring automatic billing.
TruStage's policy-servicing and disbursements dashboards, and the disbursements blocks on its outage hub and credit union page, have described the phone e-signature process for Life cancellations since October 27, so this is that route reaching the page individual policyholders are most likely to read, not a new development. Those surfaces name only Life cancellations; this answer adds that AD&D cancellations still need the form.
At this check the page's next answer, on making changes or cancelling, still told policyholders to follow the instructions on the applicable form and said many transactions must be submitted by mail, and the credit union page's matching member answer still gave only the forms route. The individual page carries no “Last Updated” stamp; the five dated outage pages' shared stamp rolled to October 29, 8:23 a.m. CT in the same window with no other change in wording.
TruStage Life of Canada's incident FAQ is back at its English and French addresses on trustage.ca, word for word as it read before the October 27 takedown, including the “Investigating” status. TruStage has explained neither the removal nor the return.
Between our 10:05 a.m. and 12:05 p.m. Eastern checks on October 28, trustage.ca/en/faq.html stopped redirecting to the trustage.ca homepage and again serves TruStage Life of Canada's service-disruption FAQ; the French address, /fr/faq.html, loads its French counterpart again as well. The English text is identical to our last copy before the takedown, taken at 2:05 p.m. on October 27.
The restored page keeps everything it carried before: the status of “Investigating,” the earlier answer on data access, the Mandiant containment answer, the statement that TruStage Life of Canada has filed all required notices with its Canadian regulators, including Assuris, and the 1-888-977-3752 line, weekdays 8 a.m. to 5 p.m. Central.
The page was offline for less than a day. TruStage has posted nothing about either change, so we cannot say whether the redirect was deliberate. The U.S. outage pages were not affected.
All six TruStage outage pages that answer the cybersecurity-expert question now cite Mandiant's October 9 memo: environment clean, incident contained, no indication of active intrusion, based on evidence reviewed to date. It is not a data-exposure finding.
Between our 4:05 p.m. and 6:05 p.m. Eastern checks on October 27, TruStage replaced the cybersecurity-expert answer on its business, wealth management solutions and retirement outage pages with the wording the credit union, annuity and preneed pages took two hours earlier. It cites Mandiant's October 9 memo update and, based on the forensic evidence reviewed to date, attributes three findings to Mandiant: TruStage's operating environment is clean, the incident is contained, and there is no indication of any active intrusion. It adds that systems return to service in the new environment only after Mandiant validates them, and that the investigation and recovery remain ongoing.
That completes the rollout: every outage page carrying the question now gives the same answer, and each links the same October 9 memo. The business and wealth management pages had cited the August 27 update. The retirement page had carried the oldest version still live, a short yes saying TruStage continues to work with Mandiant, with a pointer to the latest memo. The wealth management page carried the clean-and-contained sentence from September 11 to 14 before TruStage withdrew it; this is its return there. The individual outage page carries no Mandiant answer.
None of this is a finding about data. TruStage's separate answer on whether customer information was accessed did not change on any of the three pages: the review continues, and TruStage says it will notify affected people directly if information is found to have been accessed.
TruStage's preplanning outage page says it is preparing to resume paper bills for some Preplanning policies, with no date. Its past-due warning now covers only notices saying a Preplanning payment is delinquent and coverage is about to end, not payment requests in general.
Between our 4:05 p.m. and 6:05 p.m. Eastern checks on October 27, TruStage rewrote the billing answers on its preneed outage page, the one that serves preplanning customers. A merged answer now says TruStage previously resumed recurring monthly ACH and credit card payments for certain Life, AD&D and Preplanning customers, that it has resumed AD&D paper bill mailings, and that it is preparing to resume paper bill mailings for some Preplanning policies. It gives no date for the preplanning bills and does not say which policies they will cover.
The same edit narrowed the page's past-due warning. The page had said TruStage was not sending any communications requesting premium payments or saying a payment was delinquent. The new answer says only that TruStage is not sending notices telling customers a Preplanning payment is delinquent and they are about to lose coverage, and it keeps the advice not to click links or give personal or payment information in response to one. It adds that customers will not lose coverage because they cannot make a payment during the disruption, and that grace-period accommodation remains in place. The individual and credit union pages dropped their versions of the warning earlier the same day, so no TruStage page we track still says the company is sending no payment requests.
TruStage also removed the answer explaining why some customers saw an August premium drafted when July's had not been, which had said representatives could not see individual account information. The page's other payment guidance did not change: policies that are active or in a grace period stay that way until normal payment processing resumes, and TruStage still says it will extend grace periods for Life, AD&D and Preplanning coverage.
TruStage's credit union page says direct mail and email marketing for AD&D, life and auto insurance is paused, with no end date; it had said the pause ran through November. It also says BenefitsForYou access is expanding to plan sponsors, advisors and administrators.
Between our 2:05 p.m. and 4:05 p.m. Eastern checks on October 27, TruStage rewrote two credit-union-facing answers on its credit union outage page. The marketing answer now says direct mail and email marketing for AD&D, Life and Auto Insurance products is currently paused, dropping the end date it had given, through November. Future marketing is still being evaluated, and members may still see materials already distributed through credit unions, such as website banners, branch materials and brochures.
The BenefitsForYou answer, which appears twice on the page, now says the site has been stable since its initial launch to participants and that digital access is expanding to plan sponsors, advisors and third-party administrators. Contribution and withdrawal backlogs continue, it says, though retirement account data has become more current as processing catches up, and broader transaction capabilities will return in later phases. It no longer says displayed balances may not reflect recent payroll contributions; the servicing and disbursements dashboards still do.
TruStage Life of Canada took down its incident FAQ on October 27: its English and French addresses on trustage.ca redirected to a redesigned homepage with no outage notice, and TruStage gave no explanation. It restored the FAQ unchanged the next day.
Between our 2:05 p.m. and 4:05 p.m. Eastern checks on October 27, the English and French addresses of TruStage Life of Canada's service-disruption FAQ, trustage.ca/en/faq.html and /fr/faq.html, began redirecting permanently to a redesigned trustage.ca homepage. Neither that homepage nor its help centre mentioned the cyberattack, the outage or Mandiant, and the status banner the FAQ carried was gone. TruStage posted nothing explaining the change.
The FAQ was the Canadian affiliate's only public incident page. It showed a status of “Investigating” and the earlier answer on data access, and it was the one TruStage page that said the company had filed all required regulatory notices, a statement scoped to TruStage Life of Canada and its Canadian regulators, including Assuris. It served Canadian preplanning customers.
The removal said nothing about the U.S. outage pages, which remained posted and were updated in the same window. Between our 10:05 a.m. and 12:05 p.m. checks on October 28, TruStage restored the FAQ at both addresses, unchanged; see the October 28 item.
TruStage's credit union, annuity and preneed outage pages now cite Mandiant's October 9 memo: environment clean, incident contained, no indication of active intrusion, based on evidence reviewed to date. It is not a data-exposure finding. The business, wealth management and retirement pages followed later on October 27.
Between our 2:05 p.m. and 4:05 p.m. Eastern checks on October 27, TruStage replaced the answer to its cybersecurity-expert question on the credit union, annuity and preneed outage pages. The old answer cited Mandiant's August 27 memo update and said Mandiant had found no evidence of threat-actor activity since July 11. The new one cites the memo's October 9 update and attributes three findings to Mandiant, based on the forensic evidence reviewed to date: TruStage's operating environment is clean, the incident is contained, and there is no indication of any active intrusion. It adds that Mandiant has seen no threat-actor activity in the environments in scope since July 11, that systems and workstations return to service in the new environment only after Mandiant validates them as clean and safe, and that the investigation and recovery remain ongoing.
This is the affirmative wording TruStage published on the annuity and wealth management pages on September 11 and withdrew from both by the evening of September 14; it stood on three pages at this check. The business and wealth management solutions pages still carried the August 27 answer at this check; both, and the retirement page, took the October 9 answer by our 6:05 p.m. check the same day. The memo link has opened the October 9 memo since mid-October.
None of this is a finding about data. TruStage's separate answer on whether customer information was accessed did not change on any of the three pages: the review continues, and TruStage says it will notify affected people directly if information is found to have been accessed.
TruStage's credit union page says more life claims are moving toward payment, but large claim inventories remain and AD&D claims are progressing more slowly because some information needed to review them is not yet available. It no longer mentions added intake staff or chat help.
Between our 2:05 p.m. and 4:05 p.m. Eastern checks on October 27, TruStage rewrote the claims status answer on its credit union outage page. It now says more life claims are moving toward payment as access to beneficiary and benefit information improves, while substantial inventories remain and many customers are still seeing delays. Progress is slower for AD&D claims, it says, because some information needed to review them is not yet available through current processes. Digital First Notice of Loss improvements are capturing more information up front, and lending claim submission has expanded digital capabilities. The answer follows the consumer FAQ's October 26 rewrite.
Three statements came out with the old answer: that TruStage had regained visibility into certain systems holding the policy and document records claims depend on (added October 8), that it had added staff for first-notice-of-loss intake to cut call-center waits, and that chat on the updated outage hub could help with forms questions (both added October 13). On the claims dashboard, the AD&D note likewise dropped its sentence saying teams have access to additional systems and documents for AD&D adjudication; it now says only that the backlog continues and processing is delayed. The life note keeps its additional-systems sentence.
TruStage still says it cannot give claim-specific payment timelines and that customers who already filed should not submit a duplicate claim. Expect AD&D claims, especially those needing medical records, to take longer.
TruStage says credit unions and lending partners are beginning to regain the product APIs and PAX interface used to enroll and transact, through a phased rollout that starts with pilot and partner testing. Affected partners will hear about timing and reactivation steps. No date is given.
Between our 2:05 p.m. and 4:05 p.m. Eastern checks on October 27, TruStage added a lending products question to its credit union outage page. It says credit unions and lending partners are beginning to regain the capabilities they use to enroll and transact through TruStage's product APIs and the PAX interface, with pilot and partner testing as the first stage of a phased rollout. Impacted partners will receive information on timing, reactivation and any steps they need to take as capabilities become available. The answer gives no date and does not say which credit unions are in the pilot.
A second new answer says credit unions can submit lending claims in bulk through an expanded digital intake, with a member-facing form that gathers more complete information up front. On the claims dashboard, the payment protection note adds that the lending support team has a new reporting view of pending claims to help answer credit union questions, and that claims data cleanup is complete, which TruStage says supports preparation for expanded post-incident bulk payments. It gives no payment date.
Members who call TruStage's contact center to cancel a life policy can now sign the request electronically, which TruStage says speeds processing; the print-and-mail form remains an option. Surrender backlogs remain, and TruStage still says it will honor the date of requests.
TruStage's servicing and disbursements dashboards, and the restamped “Oct. 27” update blocks on its outage hub and credit union page, now say an electronic-signature process for life cancellation requests is available when customers call the contact center. The servicing dashboard says the process speeds up request processing and that customers may still print and mail the form from the service forms page. Teams are still working through the backlog of life surrender requests, delays continue, and TruStage says it will honor the date of requests.
The disbursements block on the hub and credit union page dropped its references to phased issuance of delayed annuity contracts and to expanding retirement participant access, and now names only the life surrender backlog and the e-signature process. The claims and servicing blocks took the new date with no change in wording. Both pages also added a line telling owners of SEC-registered index-linked annuities, variable annuities and variable life contracts to consult the status dashboards and the prospectus supplements they received.
The servicing dashboard's AD&D note was rewritten in the same pass: paper billing for AD&D customers not on recurring automatic billing is targeted to restart this week, eligible cancellations can still come off recurring billing while the request is processed, and many requests still require forms or manual processing.
TruStage's annuity outage page now lists 800-798-5500 for its annuity contact center, replacing 855-591-9027, which no TruStage page we track still carries. Hours are unchanged: weekdays 8 a.m. to 5 p.m. CT. Update the number anywhere you posted it.
Between our 2:05 p.m. and 4:05 p.m. Eastern checks on October 27, TruStage replaced 855-591-9027 with 800-798-5500 as the annuity contact center number on its annuity outage page. 800-798-5500 is the number its policy and contract servicing dashboard already listed, so the outage page and the dashboards now agree, and the disbursements dashboard's annuity note names it too. The hours line, weekdays 8 a.m. to 5 p.m. CT, did not change. TruStage has not said whether the old number still answers.
The same edit narrowed the one exception to on-schedule systematic withdrawals: the annuity page now says the sweep exception applies to fixed annuity contracts, and customers who need one should still request a one-time withdrawal on the partial withdrawal form.
On the servicing dashboard, the annuity note now lists what the contact center can help with, including direct-deposit changes, application cancellations, allocation transfers and changes, withdrawals, surrenders and death claims, points to forms on the annuity outage hub, and adds a link to that hub. Its phased-issuance line now says teams are issuing annuity contracts for applications received before and during the outage; it previously called them delayed contracts. The disbursements dashboard's annuity note dropped the phased-issuance line and says disbursements are being processed, though requests may take longer than normal.
TruStage says it is resuming AD&D paper bill mailings in the last week of October for customers not on automatic payments, so a mailed AD&D bill may be genuine. Its individual and credit union pages no longer say it is not sending payment requests.
Between our 2:05 p.m. and 4:05 p.m. Eastern checks on October 27, TruStage rewrote the billing answers on its individual and credit union outage pages. Both now say AD&D paper bills are going back out to customers who are not on recurring ACH or credit card payments, starting the last week of October, and that those mailings will continue. The pages use mixed tenses: a new question on each, asking whether a mailed AD&D bill is really from TruStage, says the mailings resumed, while the billing answer beside it says TruStage is resuming them, and the servicing dashboard says the restart was targeted for this week. Members paying by mail should write the policy number on the check or money order; addresses remain at trustage.com/outage/individual/payments. The individual page adds that customers on recurring ACH or card billing can ask TruStage to switch them to paper bills.
The same edit removed both pages' answers saying TruStage was not sending premium-payment requests or delinquency notices and telling members not to respond to one. The consumer FAQ dropped that answer on October 26, so at this check the warning remained only on the preneed outage page. TruStage notes that some standard sections of the new bill mention automatic-payment setup and online policy management, which are not yet restored, and says customers should mail a check for now.
One-time payments online or by phone remain unavailable, and TruStage repeats that no one will lose coverage because they cannot make a payment during the disruption and that grace-period accommodations remain. The individual page also dropped its statements that TruStage cannot mail bills or give a past-due total, that representatives cannot verify payment activity, and that recurring payments had resumed for most customers; both pages now say TruStage previously resumed recurring ACH and card payments for AD&D and Life policies, without the August dates. The payments sub-page still says TruStage cannot mail a bill. The preneed page kept the older wording at this check and was rewritten by our 6:05 p.m. check the same day, narrowing its warning to preplanning delinquency notices.
TruStage's consumer FAQ now says large claims backlogs remain, especially for recently filed claims, as more life claims move toward payment. It also dropped its past-due-notice scam warning, which three outage pages still carry, and the only grace-period list that named Payment Guard Advantage.
Between our 4:05 p.m. and 10:17 p.m. Eastern checks on October 26, TruStage rewrote the claims answers on its consumer FAQ. The answer on when claims will be processed or paid now says more life claims are moving toward payment as access to beneficiary and benefit information improves, but that large backlogs remain, especially for recently submitted claims, and that many customers will keep seeing longer-than-normal processing times. Product-specific timelines are still unavailable. The answer on filing a claim now points customers to an updated First Notice of Loss form, which TruStage says gathers more information up front and can cut down on follow-up contact.
The same edit deleted two answers. One said TruStage is not currently sending premium-payment requests or delinquency notices and told anyone who gets one not to click links or give out personal or payment information. That warning still appears on the credit union, individual and preneed outage pages, and TruStage has not said it has resumed such notices. The other listed the coverages getting extended grace periods as Life, AD&D, Preneed and Payment Guard Advantage and said TruStage was still evaluating how missed premiums will be handled. The FAQ's remaining grace-period answer names Life, AD&D and Preplanning only, and no TruStage page we track now names Payment Guard Advantage in the grace-period promise. The still-evaluating statement survives on the preneed outage page, and the credit union page says TruStage is evaluating customer payment scenarios. A sentence saying credit insurance, debt protection and GAP claims continue to be accepted and processed also came off the FAQ; the claims dashboard still says so.
The FAQ's “Last Updated” stamp did not move with the edit and still reads October 26 at 11:15 a.m. CT. TruStage's five dated outage pages re-stamped to October 26 at 3:11 p.m. CT in the same window with no change to their text. Our 6 p.m. and 8 p.m. checks did not run, so the edit cannot be timed more closely.
TruStage's claims dashboard now shows annuity death claims available at every step, including payout, which had read unavailable at every check since August 20. It says interim processes now support these claims; beneficiaries still file through the annuity outage page.
Between our 8:49 a.m. and 10:04 a.m. Eastern checks on October 26, TruStage changed the annuities section of its claims dashboard. The section's overall label and its submission and processing rows moved from partially available to available, and its payout row moved from unavailable to available. Payout had read unavailable at every check of the dashboard since we began tracking it on August 20.
The note above the rows was rewritten. It had said claims intake remained available and that TruStage's ability to process and pay claims continued to expand as servicing and operational capabilities returned. It now says TruStage has put interim processes in place to support death benefit claims, and it still directs beneficiaries to submit new death claims through the annuity outage page. The note carries no “NEW” tag, and the dashboard prints no date.
The dashboard does not say how long payment takes or whether claims filed earlier have now been paid, and TruStage describes the processes as interim. Its policy servicing and disbursements dashboards already listed annuity death-claim support among capabilities that remain available; the outage hub, credit union page and annuity outage page did not change at the same check. Every other claims line on the dashboard except mechanical repair coverage and brokered commercial products remains partially available.
TruStage's credit union claims page now lists Business Protection products, among them bond, business auto, collateral protection, liability and property, with a Start claim button. The button opens the same general claim form the page already linked, so the filing channel is unchanged.
Between our 10:05 a.m. and 12:05 p.m. Eastern checks on October 23, TruStage added a Business Protection products section to its credit union claims page, trustage.com/outage/business/credit-union/claims. The section names six lines of the credit union's own business coverage, among them bond, business auto, collateral protection, liability and property, and carries a Start claim button. The page's heading now describes credit union claims submission in general rather than filing on behalf of a member, and the general claim form is now offered for claim types the page does not list.
The new button opens connect.trustage.com/startclaim, the same general claim form the page already linked. That form has offered a Business Protection claim type since our first check of it on August 11, so this adds no new filing channel; it puts business-coverage claims on the page credit unions use for claims. TruStage's claims dashboard has shown Bond Suite claims as partially available, with a submission link, since we began tracking it on August 20, and TruStage's credit union outage page still sends Business Protection servicing requests, such as certificates of insurance, to BusinessProtection@trustage.com.
In the same edit, the credit insurance and debt protection button was relabeled Start claim; it had read Continue. The page carries no date stamp, and the five dated outage pages did not change in the same window. We re-fetched the live page after our 12:05 p.m. check and confirmed the new section and where its button leads.
TruStage's Wealth Management Solutions page says managed advisors and managed and dual credit unions have been paid as regularly scheduled since the beginning of August, with no further exceptions expected. It also now says some Salesforce capabilities remain limited despite direct login.
Between our 4:05 p.m. and 6:05 p.m. Eastern checks on October 23, TruStage rewrote two answers on its Wealth Management Solutions outage page. The compensation answer, now first in the page's FAQ, says TruStage Wealth Management Solutions has paid managed advisors and managed and dual credit unions as regularly scheduled since the beginning of August, and that it does not expect any further exceptions to that process. The answer it replaced, in place since August 31, said managed advisors and dual credit unions were paid as scheduled for all of July and August and that July's estimated payments were recouped against actuals in August.
Three things moved in that answer. Managed credit unions are now named alongside dual credit unions; the period now runs from the beginning of August forward instead of ending with August; and the July estimates and their recoupment are no longer mentioned. A credit union reconciling a July remittance will not find that history on the page now; the page's closing line sends questions to the account representative.
The Salesforce answer still says advisors and credit unions can sign in directly, but it now adds that some capabilities remain limited while TruStage restores the connecting systems they depend on. It no longer tells readers to get sign-in instructions from their assigned Advisor Manager Specialist or Regional Program Consultant.
The page's shared last-updated stamp did not move with the edit; it still reads October 20 at 12:05 p.m. CT. The other four dated outage pages did not change in the same window. We re-fetched the live page after our 6:05 p.m. check and confirmed both answers.
TruStage's credit union page adds a Claims FAQ on its enhanced Digital FNOL claim form. The link is unchanged, it covers all credit insurance, debt protection and GAP loss types, and it takes only the last four digits of account and loan numbers, never Social Security numbers.
Between our 4:05 p.m. and 11:37 p.m. Eastern checks on October 20, TruStage added a Claims topic to the FAQ on trustage.com/outage/business/credit-union, with seven questions on Digital FNOL (First Notice of Loss), its online claim-submission experience for credit unions. TruStage says the enhancements were deployed to the existing FNOL link, so credit unions keep using the claim-reporting link they already have. The form captures more information at submission, which TruStage says may mean fewer follow-up requests, and lets a credit union submit several claims without re-entering its own details each time.
On member data, TruStage calls the form its official claim-submission experience and says it is designed to limit sensitive information: Social Security numbers, full account numbers and full loan numbers should not be entered, and the form requests and accepts only the last four digits of account and loan numbers. It covers all credit insurance, debt protection and GAP loss types, with one form for credit insurance and debt protection claims and a separate form for GAP. Claims may still contact the credit union after a submission if it needs more documentation or clarification.
The same edit retagged the page's alert list. The plastic card notice lost its "NEW" label, and two lines marked "Updated" now link to the page's existing answers on claims processing and payments and on viewing balances in BenefitsForYou; neither answer's wording changed in this edit. The "What happened?" answer now names trustage.com/investigation-faqs in its text as the address for the technical FAQs.
The page carries no "Last Updated" stamp and does not say when the enhancements were deployed; the five dated outage pages did not change in the same window. TruStage's claims dashboard has said since October 13 that credit unions can submit lending FNOLs in bulk (item 2026-10-13-trustage-claims-dashboard-bulk-fnol-lending). This is the first statement on any page we track about what the form should and should not collect.
TruStage's claims dashboard now says life and AD&D claims teams have access to additional systems and records for claim decisions; since late September it had said that access was being put in place. A backlog still slows processing, and the dashboard gives no dates.
Between our 12:05 p.m. and 2:05 p.m. Eastern checks on October 20, TruStage rewrote one sentence in each of the life and AD&D notes on its claims dashboard and tagged both “NEW.” Since late September both notes had said teams were implementing additional document-access capabilities to help claims teams reach beneficiary information and historical claim documentation needed for decisions.
The life note now says teams have access to additional systems and historical documentation for decisioning and processing, and that processing times may be longer than normal while the backlog is worked. The AD&D note says the additional systems and documents are being used to support AD&D claims adjudication, and that processing times are delayed by a backlog. The AD&D note still says faxed medical-record information remains unavailable, which continues to affect AD&D claims that require medical records. Submission, processing and payout remain partially available for both products.
The payment protection note lost its “NEW” tag without a wording change. The same afternoon TruStage restamped the claims block on its outage hub and credit union page “Oct. 20” without changing its wording.
The dashboard gives no figures and no dates, so the change does not tell a member when a particular claim will be decided. For life and AD&D claims, it is the first statement since late September that the added records access is in use rather than being built; AD&D claims that need faxed medical records are still affected.
TruStage's servicing and disbursements dashboards now say plan sponsors, advisors and third-party administrators are gaining visibility into defined contribution participant balances, alongside participants' phased BenefitsForYou access. They do not say how or when sponsors get it, and no availability label moved.
Between our 12:05 p.m. and 2:05 p.m. Eastern checks on October 20, TruStage added one sentence to the retirement notes on its policy and contract servicing and disbursements dashboards: plan sponsors, advisors and third-party administrators are also gaining visibility into defined contribution participant balances. Nothing else in either note changed. Both still say BenefitsForYou online access has returned through a phased approach for participants who previously set up an online account, and that balances shown may not yet include recent payroll contributions, earnings adjustments or other transactions still being processed; the disbursements dashboard still says participants must reset their password first. No availability label moved, and the retirement rows remain partially available.
The dashboards do not say how sponsors, advisors or administrators reach the balances, which plans are included, or how far the rollout has gone. TruStage's retirement information site, which did not change, says plan sponsors and authorized fiduciaries of plans that use Matrix as custodian have access to account information through Matrix. The servicing dashboard lists 1-844-999-2677 for retirement plan sponsors.
The same afternoon TruStage restamped the three “Latest update” blocks on its outage hub and credit union page “Oct. 20” and removed the “NEW” tags from the servicing and disbursements blocks without changing their wording, and the shared “Last Updated” stamp on five of its outage pages moved to October 20, 12:05 p.m. CT with no change to their text.
For a credit union that sponsors a TruStage retirement plan for its own employees: TruStage says sponsor visibility is arriving, not that it has arrived for every plan. Confirm with TruStage on the sponsor line whether your plan's participant balances are visible to you before relying on them, and expect them to lag recent payroll.
TruStage's retirement site now names tax-exempt 457(b) and deferred compensation plans, alongside 401(k), 403(b) and governmental 457(b) plans, in its participant answer on interim withdrawals and loans. The sponsor answer still names only the original three plan types.
Between our 10:05 a.m. and 12:05 p.m. Eastern checks on October 19, TruStage edited the participant answer on withdrawals for defined contribution plans on its BenefitsForYou information site. The answer had said withdrawal services were available to 401(k), 403(b) and governmental 457(b) plans that use TruStage's Matrix recordkeeping (plans not on its Choice Group Variable Annuity), except where noted. It now also names tax-exempt 457(b) plans and deferred compensation plans.
The steps did not change: call the Participant Service Center at 800-999-8786 for the form, complete it, and return it to the plan administrator for review and approval; TruStage Pooled Employer Plan participants submit the form through the secure portal instead. Availability still depends on each plan's provisions and eligibility requirements.
The sponsor answer on the same site was not edited and still names only 401(k), 403(b) and governmental 457(b) plans. TruStage did not announce the change, and the page does not say whether it opens the process to plans that could not use it before or completes a list that was missing them. A credit union whose employees hold a TruStage tax-exempt 457(b) or deferred compensation plan can point participants to the interim process, but should confirm with TruStage before telling anyone a request will be accepted.
The site carries no “last updated” stamp, so the edit is dated by comparing our captures.
TruStage's memo link now opens a Mandiant investigation memo dated October 9: no threat-actor activity since July 11 and none seen touching third-party files or systems, within Mandiant's scope. It is not a data-exposure finding; TruStage's vendor FAQs, updated October 15, cite it.
TruStage has replaced the Mandiant memo behind trustage.com/mandiant-investigation-memo, the undated address its outage pages link. At this tracker's October 16 check that address opened an investigation memo Mandiant dates October 9, 2026, in place of the August 27 version linked here since September 3. Based on the forensic evidence reviewed so far, Mandiant says TruStage's operating environment is clean, the incident is contained, and it sees no sign of an active intrusion. It has identified no threat-actor activity in the environments within its investigation's scope since July 11, and has not seen the threat actor interact with files shared with third parties or with any third-party systems, portals, VPNs, APIs, or other environments connected to TruStage. The memo adds that systems and workstations return to service in the new environment only after Mandiant validates them, and that the investigation and recovery remain ongoing.
The same afternoon TruStage repointed the Investigation FAQs link on its outage-information status page to a new undated address, trustage.com/investigation-faqs. The document it opens is written for vendors and partners, is marked last updated October 15, and cites the October 9 update in two answers, including the one on whether organizations connected to TruStage should be concerned; it says TruStage is not aware of any action partners or vendors need to take beyond their normal security practices. The older dated address, investigation-faqs-081026, now opens the same updated document. Both documents are linked under Resources below; each opens a PDF viewer rather than downloading a file.
Read it narrowly. Mandiant confines its conclusions to the evidence reviewed to date and to the environments within its investigation's scope, which it does not define. Nothing here is a finding about whether data was accessed, which TruStage says is still under review with Mandiant and Epiq Global, and no service status on TruStage's pages moved with this change. For a vendor-management file, the practical point is that the memo filed from this page before today is no longer the one TruStage links.
As of October 16, five outage pages (business, credit union, annuity, preplanning, and wealth management solutions) still say Mandiant updated its memo on August 27, while the link they carry opens the October 9 version, so the date printed on those pages no longer marks the current memo. No page this tracker monitors announced the new memo; it surfaced when the status page's FAQ address moved.
Update, October 27: all five pages, and the retirement page, now print the October 9 date.
TruStage's credit union outage page no longer lists the claim types it has started paying or says pre-outage life and AD&D claims are worked first. It still says claims are generally worked in the order received. Its consumer FAQ keeps the claims-paid list.
Between our 10:05 a.m. and 12:05 p.m. Eastern checks on October 15, TruStage edited the claims answers on its credit union outage page. It deleted the whole answer to “If billing is resuming, are claims also being paid?” That answer said TruStage had started paying claims across its business, naming preplanning and funeral, GAP, and debt protection and credit insurance; that life and AD&D claims pending at the time of the outage would be worked before claims received afterward; and that a claims representative would contact whoever filed a claim. TruStage also deleted the paragraph repeating the life and AD&D ordering from its answer on the current status of claims processing and payments.
What remains on the page: claims processing and payment activity continue to expand, claims that need more documentation or coverage validation may take longer, and product-specific claim payment timelines are not available. A separate answer, added October 8, says claims are generally worked in the order received but paid once all required information is in. The page gave no reason for the deletions and carries no date stamp.
For credit unions, the claims-paid answer to a member does not change: TruStage's consumer FAQ still says claim payments have resumed for preplanning and funeral, GAP, and debt protection and credit insurance. The ordering does change. The statement that pre-outage life and AD&D claims go first now appears on no TruStage outage page or dashboard we track, only in the August 13 newsroom release, so do not cite it as current; the order-received answer is TruStage's live wording.
Two smaller edits landed in the same window. The answer on cancelling a Life or AD&D policy now says TruStage will remove customers from automatic recurring billing when they ask to cancel or surrender, where it had said TruStage can now do so, the change the individual outage page made on October 14. The answer on policy changes now opens with the sentences on Life surrender requests, which also still close it. We re-fetched the live page after our 12:05 p.m. check and confirmed the deletions.
TruStage's consumer FAQ and individual outage page now say BenefitsForYou online access is returning in phases for participants who already had an account, who may need to reset a password first. Its dashboards and credit union page already said so.
Between our 4:04 p.m. and 6:05 p.m. Eastern checks on October 14, TruStage rewrote the retirement-access answer on its consumer FAQ and added to the same answer on its individual outage page. On the consumer FAQ the question now reads “When will I be able to access my 401(k)/retirement accounts?” and the one-line answer, that online access remained limited while balance visibility and broader digital access were restored, became two paragraphs. The first matches the individual page's existing answer: online access is limited for retirement plan participants, balances and benefits were not affected, and some participants may be able to request withdrawals and loans, where their plan permits, and get balance updates by phone. The second says BenefitsForYou online access is being restored in phases, that participants who previously set up a BenefitsForYou account are regaining access to their retirement account information and may be asked to reset their password, and that available information and functions may vary by plan and platform.
The individual outage page added a similar paragraph, saying also that certain transactions may still need help from the service center while more capabilities return. TruStage's policy-servicing and disbursements dashboards have carried phased-access wording since October 6 and its credit union page since October 13, so this is the answer spreading to two more pages, not a new development. The outage family's shared “Last Updated” stamp rolled to October 14, 3:20 p.m. CT in the same window, with the stamp line the only change on the five dated pages; the individual page carries no stamp.
One wording change on the individual page: its answer on cancelling a Life or AD&D policy now says TruStage will remove customers from automatic recurring billing when they request cancellation or surrender, where since October 8 it had said TruStage can now do so. The page still says such customers come off recurring billing.
On October 14 TruStage removed its claims-paid totals — over $60 million Individual Life, more than $44 million lending and property-and-casualty — from its consumer FAQ, the last surface we track that carried any. It also dropped its line that review of post-July 11 GAP claims had begun.
Between our 4:04 p.m. and 6:05 p.m. Eastern checks on October 14, TruStage edited the claims answer on its consumer service-disruption FAQ at engage.trustage.com. It deleted the sentence, published September 15, reporting that over $60 million in Individual Life claims and more than $44 million in lending and property-and-casualty claims had been paid since the attack, and the clause saying review of GAP claims submitted after July 11 had begun. The rest of the answer stands: product-specific claim payment timelines are not available; claim payments have resumed for preplanning and funeral, GAP, and debt protection and credit insurance; life and AD&D claim processing continues to expand; and credit insurance, debt protection and GAP claims continue to be accepted and processed.
These were the last claims figures on any TruStage surface this tracker follows. The outage hub and credit union page dropped their claims count overnight into September 19, and the claims dashboard dropped its payment protection percentages on September 25. TruStage gave no explanation, published no replacement figure, and has not said the totals were wrong. Read any figure saved from the FAQ as what TruStage reported between September 15 and October 14, not as a current count.
The FAQ's “Last Updated” stamp did not move with the edit: it still read October 14, 11:15 a.m. CT, its daily re-stamp, when we re-fetched the live page after our 6:05 p.m. check and confirmed both deletions. The same edit rewrote the FAQ's retirement-access answer; see the companion item.
TruStage's retirement outage page now says participants with an existing BenefitsForYou account can see available account information online after a password reset, matching its dashboards. It also took the October 7 data answer, the last of the seven outage pages to do so.
Between our 4:04 p.m. and 9:45 p.m. Eastern checks on October 13, TruStage rewrote two answers on its retirement outage page, in both the participant and the plan sponsor sections. The answer on when system access will be restored no longer says BenefitsForYou.com was deliberately taken offline and participants cannot log in. It now says participants who already had an online account can view available retirement account information after resetting their password; that some will see balances as of a specific market-value date while account details are updated; that recent activity may not show yet; and that participants without an account will be able to register in a later phase.
The answer on when TruStage will know more about whether data was compromised now gives the October 7 wording: outside experts are still investigating, and anyone whose information is found to have been accessed will be notified directly. At our 9:45 p.m. check on October 13, all seven outage pages carried it; the consumer FAQ and TruStage Life of Canada's FAQ still carried the earlier answer.
Neither change reports a new finding or a new restoration step. The BenefitsForYou wording matches what TruStage's dashboards have said since October 6 and its retirement information site since October 8. The page's October 13, 8:37 a.m. CT stamp did not move with the edit.
TruStage's claims dashboard says credit unions can now submit detailed First Notice of Loss forms in bulk for lending claims, which it says reduces manual handling and speeds intake. It does not describe the bulk format; its claim links lead to a credit union claim-filing page.
Between our 2:05 p.m. and 4:04 p.m. Eastern checks on October 13, the payment protection note on TruStage's claims dashboard gained a new first sentence: credit unions can now submit detailed First Notice of Loss forms in bulk for lending claims, which TruStage says reduces manual handling and accelerates intake. A new closing sentence says teams continue scaling claim-adjudication and payment workflows for post-incident claims, including bulk intake, data cleanup and claims-payment processes. The note still says credit insurance, debt protection and GAP claims are being accepted, reviewed, processed and paid, and submission, processing and payout all remain partially available.
The dashboard does not describe the bulk format or name a separate channel. Its claim links lead to trustage.com/outage/claims, which asks whether the filer is an individual or a credit union employee; the credit union path, trustage.com/outage/business/credit-union/claims, offers claim forms for credit insurance and debt protection and for GAP products, plus a general claim form.
This is the first statement about post-outage claims on the dashboard since October 6, when TruStage removed its note that it had begun contacting members or credit unions for information on those claims. It carries no figures and no dates.
TruStage's October 13 update says BenefitsForYou digital access has returned for many retirement participants, and its dashboards now say online access has returned in phases for those who already had an account. Balances may still lag recent contributions, and no availability label moved.
Between our 2:05 p.m. and 4:04 p.m. Eastern checks on October 13, TruStage restamped the three “Latest update” blocks on its outage hub and credit union page “Oct. 13.” The policy and contract servicing block adds one sentence: BenefitsForYou digital access has returned for many retirement participants. The disbursements block now says phased issuance of delayed annuity contracts is continuing rather than beginning, and adds system dependencies to what may affect completion times. The claims block's wording did not change.
The retirement notes on the policy and contract servicing and disbursements dashboards changed the same afternoon. Both now say BenefitsForYou online account access “has returned through a phased approach,” where since October 6 they had said it was returning. Participants who previously set up an online account may be able to view retirement account information, and balances shown reflect current values as of the most recently processed cycle date and may not yet include recent payroll contributions, earnings adjustments or other transactions still being processed. The disbursements dashboard still says participants must reset their password first; the servicing dashboard's note no longer mentions the reset. No availability label moved; the retirement rows remain partially available.
The executive benefits notes on both dashboards were reworded to say servicing and distribution needs continue to be supported through third-party partners. The servicing dashboard dropped a sentence saying some servicing activities on legacy TruStage products remain limited, and kept the line that they may take additional time.
For a credit union: TruStage says access has returned for many participants, not all. A participant who already had a BenefitsForYou login can try it after a password reset and should treat any balance shown as possibly incomplete. TruStage's retirement information site said on October 8 that participants who never created an account get access in a later phase; until then the Participant Service Center at 800-999-8786 remains their route.
TruStage's credit union outage page now says BenefitsForYou online access is returning in phases for participants with existing accounts, wording its dashboards have carried since October 6. It also dropped its description of the temporary GAP claim payment process that began August 12.
In the same edit, between our 8:23 a.m. and 10:05 a.m. Eastern checks on October 13, TruStage replaced its credit union page's answer on when members and customers can view balances in BenefitsForYou, which appears twice on the page. The old answer said BenefitsForYou remained unavailable and that balance and plan benefit information could not be reached there. The new one says online account access is being restored in phases, that participants who previously set up an account are regaining the ability to view retirement account information, and that displayed balances may not yet reflect recent payroll contributions, related earnings adjustments or other transactions still being processed. TruStage's policy-servicing and disbursements dashboards have said much the same since October 6.
The rewrite also changed the answer's closing assurance. The credit union page no longer says there has been no impact to annuity or retirement account balances or benefits; it says instead that retirement plan assets remained invested throughout the disruption. The no-impact assurance still appears on TruStage's individual, annuity and retirement outage pages and its consumer FAQ, so we read this as an edit to one answer, not a withdrawal.
Separately, the page removed two paragraphs from its claims status answer that described a temporary GAP claim payment process, begun August 12, for open and pending claims established before the attack, with two payment options and with claims filed after the attack excluded. TruStage gave no explanation. The same page still lists GAP among the claim types it has started paying, its claims dashboard says credit insurance, debt protection and GAP claims continue to be accepted, reviewed, processed and paid, and the page's guidance on selling GAP during the outage, including the PAX workaround, did not change. Neither change carries a new date, figure or service label.
TruStage's credit union outage page says it has added staff to take first reports of new claims and cut call-center wait times, and that chat on its updated outage hub can help customers with questions about forms. No figure or date accompanies either.
Between our 8:23 a.m. and 10:05 a.m. Eastern checks on October 13, TruStage added three sentences to the answer on the current status of claims processing and payments on its credit union outage page. They say additional staff now support First Notice of Loss intake, the step where a new claim is first reported, to reduce call-center wait times; that chat is available on the updated outage hub to help customers with questions about forms; and that work continues on call flows, audio quality, staffing, routing and processes. The rest of the answer, including the October 8 note on regained system visibility, did not change.
For credit unions, this gives members who are stuck on a service form a place to ask besides the phone lines. TruStage gives no chat hours, no staffing figure and no wait-time target. The same page still says new claims can be reported online at trustage.com/startclaim and that a claim already submitted should not be filed again.
The chat sentence appears only on the credit union page. Our text capture of the outage hub (trustage.com/outage), unchanged at this check, shows no chat feature, and the hub's page source carries no chat code; a chat window may load only in a browser, so we have not confirmed it independently. The credit union page carries no date stamp. TruStage's five dated outage pages re-stamped to October 13 at 8:37 a.m. CT in the same window with no other change.
TruStage says it generally processes payroll files in check-date order, though a later file in good order can move ahead of one under review. A file that goes straight through follows the plan's current setup, forfeitures included; sponsors who want a change must contact TruStage first.
Between our 10:05 p.m. Eastern check on October 7 and our 8:12 a.m. Eastern check on October 8, TruStage expanded the payroll answer for defined contribution plans recordkept on Matrix (401(k), 403(b), governmental and tax-exempt 457(b) and deferred compensation plans not on the Choice Group Variable Annuity) on its BenefitsForYou information site. It says payrolls are generally processed in payroll check date order, with an exception when a file needs more review, for example missing information or unclear instructions. In that case a later file received in good order keeps processing while the earlier one waits.
On forfeitures, a file submitted in good order goes straight through using the plan's current configuration, so a plan that used forfeitures in the past will have them applied again. TruStage says it can follow special instructions not to apply forfeitures only when a file does not go straight through, that it cannot stop a file once processing has started, and that sponsors should contact it to change the plan's configuration for future submissions. The existing answer is otherwise unchanged and reordered: aggregator files through PayKonnect and Payroll Integrations process as usual, and employers who upload directly or through MoveIt use the interim secure-portal process described in TruStage's August 19 and September 18 emails.
For a credit union that sponsors a TruStage retirement plan: if the plan should not apply forfeitures to an upcoming payroll, contact TruStage to change the configuration before submitting the file, not after.
TruStage's retirement information site now tells participants who already had a BenefitsForYou account to sign in at BenefitsForYou.com, where they will be asked to reset their password. Participants who never set up an account get access in a later phase; the Participant Service Center line remains for balances.
Between our 10:05 p.m. Eastern check on October 7 and our 8:12 a.m. Eastern check on October 8, TruStage rewrote the participant balance answer for defined contribution plans on its BenefitsForYou information site at info.benefitsforyou.com. It now tells existing users to log into BenefitsForYou.com to view available account information, says they will be prompted to reset their password, and says participants who never created a BenefitsForYou account will get access in a later phase. What appears online will vary by plan and restoration phase, and recent contributions, earnings adjustments or other activity may not yet show; values may be displayed as of a specific market-value date. Participants who cannot get in online can still call 800-999-8786, weekdays 8 a.m. to 5 p.m. CT, for limited account information. On October 9 the site added that password reset emails may take several minutes to arrive, and asked participants to allow extra time before requesting another reset.
This is the first TruStage page to name the sign-in address. On October 6 its servicing and disbursements dashboards said online access was returning in phases for existing accounts but gave no address, and that evening benefitsforyou.com began showing a log-in with both Log in and Register buttons. The new answer settles the Register question: an account that did not exist before the outage cannot be created yet. The same site still says TruStage is working to restore full BenefitsForYou.com access.
The rewrite removed the answer's earlier lines saying participants' assets are secure and remain invested and that paper statements are being mailed; the statement line still appears in the site's reporting answer, and the pension answer still says plan assets are secure and remain invested. TruStage has not announced the change on any page this tracker follows.
TruStage's wealth management outage page now gives the October 7 data answer: still no finding on whether any information was accessed, and anyone found affected will be told directly. At our 10 a.m. check on October 8, four other outage pages and the consumer FAQ kept the earlier answer.
Between our 8:53 a.m. and 10:04 a.m. Eastern checks on October 8, TruStage replaced the answer to “Have you figured out if any data was compromised?” on its wealth management solutions outage page with the wording its business and annuity pages took on October 7. The earlier answer described a forensic and data-impact analysis with outside experts, said it would take additional time, and said any required notifications would go out through appropriate channels. The new answer says TruStage is still working with outside experts to understand the attack's full impact, including whether any information was accessed, and will notify each affected person directly if customer information is found to have been accessed.
This reports no new finding; it is the October 7 rewrite reaching a third page. Nothing else on the page changed, and its shared “Last Updated” stamp did not move from October 7 at 3:52 p.m. CT.
At our 10:04 a.m. check on October 8, the earlier answer still stood on the credit-union, individual, preneed and retirement outage pages, on the consumer FAQ, and on TruStage Life of Canada's FAQ. TruStage's previous rewrite of this answer took from August 26 to August 31 to reach every tracked US surface.
TruStage's credit union outage page now gives the October 7 data answer: no finding yet, and anyone found affected will be told directly. It also adds two points its dashboards already made: life surrenders are being processed, and cancelling customers can come off recurring billing.
Between our noon and 2:04 p.m. Eastern checks on October 8, TruStage replaced the answer to “When will you know more about whether data was compromised?” on its credit union outage page with the wording its business and annuity pages took on October 7 and its wealth management page took that morning. The earlier answer described a forensic and data-impact analysis expected to take additional time. The new one says TruStage is still working with outside experts to understand the attack's full impact, including whether any information was accessed, and will notify each affected person directly if customer information is found to have been accessed. A second answer, on how TruStage will keep people informed, now says updates will be posted on the outage page.
The same edit added three lines. The policy-changes answer now says the process to complete life policy surrender requests is active, that TruStage has begun working through the backlog, and that requests may take longer than normal. The cancellation answer now says TruStage can take life and AD&D customers off automatic recurring billing when they ask to cancel or surrender, though the backlog may delay when billing stops. Its servicing dashboard has carried the billing point since September 25, and both dashboards the surrender backlog since October 6. A third line says the credit union and individual outage pages now have FAQ search and that the Retirement Solutions resource site has been expanded, with navigation by role, plan and category.
This reports no new finding on data. The credit union page is the one TruStage points credit unions to, and it is the fourth page carrying the October 7 answer; at our 2:04 p.m. check on October 8, the individual, preneed and retirement outage pages, the consumer FAQ and TruStage Life of Canada's FAQ still carried the earlier one. Separately, the consumer FAQ cut its answer on when participants can reach their 401(k) to one sentence saying online access stays limited while balance visibility and broader digital access are restored. It dropped the note that some participants could request withdrawals and loans and get balance updates by phone; the individual outage page still carries the longer answer, and the consumer FAQ still says balances and plan benefits were not affected.
The credit union page carries no date stamp. TruStage's five dated outage pages re-stamped to October 8 at 12:32 p.m. CT in the same window with no other change, and the consumer FAQ took its daily 11:15 a.m. CT re-stamp.
TruStage says it has regained visibility into certain systems, giving its teams the policy and document records claims and servicing depend on. Claims are generally worked in the order received, but each is paid once complete, so a newer claim can be paid first.
Between our noon and 2:04 p.m. Eastern checks on October 8, TruStage rewrote two claims answers on its credit union outage page. The answer on the current status of claims processing and payments no longer opens by listing the claim types being paid. It now says processing and payment activity continue to expand, credits “regained visibility into certain systems” with opening access to the policy and document records needed for servicing and claims, and says testing and validation continue. Claims that need more documentation, coverage validation or supporting information may take longer. It adds that service teams are working on contact-center audio quality, call routing by intent, staffing and processes to address wait times and dropped calls.
The answer on why some claims move faster than others now explains the order. Claims are generally worked in the order received, but a payment can go out as soon as all required information is in, so a newer claim may be paid while an older one stays open awaiting information. Product type, complexity, documentation and coverage validation affect timing. TruStage says the added system visibility and better imaging and indexing of incoming correspondence are helping, while validation, manual processes and backlogs still set the pace.
For credit unions, this answers the member who asks why someone else's claim was paid first: missing information, not place in line, is the usual reason. TruStage gives no date or figure, no availability label moved, and the claims dashboard did not change. At that check the same page still listed the claim types TruStage had started paying (preplanning and funeral, GAP, debt protection and credit insurance) in another answer, and still said pre-outage life and AD&D claims are worked before those received afterward, both of which it deleted on October 15; its individual outage page kept the older, general answer on claim speed at that check and took the new one by our 4:38 p.m. check the same day.
The credit union page carries no date stamp. TruStage's five dated outage pages re-stamped to October 8 at 12:32 p.m. CT in the same window with no other change.
TruStage's individual and preneed outage pages now give the October 7 data answer: still no finding on whether any information was accessed, and anyone found affected will be told directly. At our 4:38 p.m. check on October 8, the retirement page and both FAQs kept the earlier answer.
Between our 2:04 p.m. and 4:38 p.m. Eastern checks on October 8, TruStage replaced the answer on when it will know more about whether data was compromised on its individual and preneed outage pages. It is the wording the business and annuity pages took on October 7 and the wealth management and credit union pages took earlier on October 8. The earlier answer described a forensic and data-impact analysis expected to take additional time; the new one says TruStage is still working with outside experts to learn the attack's full impact, including whether any information was accessed, and will notify each affected person directly if customer information is found to have been accessed. On both pages the answer on how TruStage will keep people informed now says updates will be posted on the outage page.
This reports no new finding on data. At our 4:38 p.m. check on October 8, six of the seven outage sub-pages carried the new answer; the retirement outage page, the consumer FAQ and TruStage Life of Canada's FAQ still carried the earlier one.
The individual page carries no date stamp, and the preneed page's October 8, 12:32 p.m. CT stamp did not move with the edit. The individual page's payment, call-hours and claim-order changes from the same edit are recorded separately.
TruStage's individual outage page now says recurring ACH and card premium payments have resumed for most customers, not just some, and lists its 1-800-779-5433 line as weekdays only, 8 a.m. to 5 p.m. CT; the Saturday 9-to-1 window is gone.
Between our 2:04 p.m. and 4:38 p.m. Eastern checks on October 8, TruStage edited several answers on its individual outage page. Two payment answers that said recurring ACH and credit card payments were beginning to resume for some eligible customers now say they have resumed for most customers. Paper billing and one-time payments are still unavailable, and representatives still cannot verify an individual customer's payment activity. The call-hours line for 1-800-779-5433 now reads Monday through Friday, 8:00 a.m. to 5:00 p.m. CT; the Saturday 9:00 a.m. to 1:00 p.m. CT window TruStage restored on September 10 is gone.
The same edit brought two lines the credit union page and servicing dashboard already carried. The cancellation answer now says TruStage can take Life and AD&D customers off automatic recurring billing when they ask to cancel or surrender. The answer on why some claims move faster now says claims are generally worked in the order received but paid once all required information is in, so a newer claim may be paid while an older one waits, and adds that the process remains manual, which delays payment.
For credit unions: correct any posted hours for this line, which no longer lists a Saturday window. Resumed for most customers is not all customers: at our 4:38 p.m. check on October 8, a billing answer higher on the same page still described the restart as covering certain Life, AD&D and Preplanning customers, and the preneed outage page and TruStage Life of Canada's FAQ kept the beginning-to-resume wording. TruStage gave no reason for ending the Saturday hours.
The individual page carries no date stamp, and the five dated outage pages kept their October 8, 12:32 p.m. CT stamp. The same edit's change to the data answer is recorded separately.
TruStage says most existing annuity systematic withdrawals, including lifetime income and required minimum distributions, are being paid on their scheduled dates. Systematic sweeps are the exception: contract owners should request a one-time withdrawal on the partial withdrawal form instead.
In the same October 7 edit, stamped 3:52 p.m. CT and caught between our 4:04 p.m. and 6:04 p.m. Eastern checks, TruStage rewrote the answer on its annuity outage page about whether systematic withdrawals have been processed. The new answer says most existing systematic withdrawals are being processed on their scheduled payment dates, and defines the term to include lifetime income payments, required minimum distributions and other recurring automatic withdrawals. It names one exception, systematic sweeps, and asks contract owners to request a one-time withdrawal on the partial withdrawal form in place of a sweep.
The answer it replaced, in place since mid-August (see the August 18 item), said all outstanding monthly systematic withdrawals had been processed, and that quarterly, semiannual and annual withdrawals were running on schedule only for certain ZoneChoice contracts and most single-premium immediate and annuitized contracts; TruStage said it had not yet identified most others through its interim processing. The new wording drops those product lists and that caveat and names no product still waiting, other than sweeps. The page does not define a systematic sweep.
The partial withdrawal form, in single-owner and joint-owner versions to print and mail, was already on the page. The separate answer telling owners who missed an expected systematic withdrawal to contact their financial professional or TruStage's contact center did not change.
TruStage still reports no finding on whether any data was accessed. Its business and annuity outage pages now say that if customer information turns out to have been accessed, TruStage will contact each affected person directly with next steps. At our October 7 check, its other pages kept the earlier answer.
Between our 4:04 p.m. and 6:04 p.m. Eastern checks on October 7, TruStage rewrote two answers in the outage FAQ on its business page and its annuity page, and moved the shared “Last Updated” stamp on its five dated outage pages to October 7 at 3:52 p.m. CT. On the question of when it will know more about whether data was compromised, the answer in place since late August described a comprehensive forensic and data-impact analysis with outside experts, said that analysis would take additional time, and said any required notifications would go out through appropriate channels. The new answer says TruStage is still working with outside experts to understand the attack's full impact, including whether any information was accessed, and that if customer information is found to have been accessed, it will notify each affected person directly with next steps.
The rewrite reports no finding either way. What moves is the commitment: the earlier wording left the notification route open, while the new wording says affected individuals will hear from TruStage directly. It also drops the statement that the analysis will take additional time, without offering a date in its place. A second answer, on how TruStage will keep people informed, now says updates will be posted on the outage page, replacing a general promise to communicate appropriately. Separately, TruStage's credit-union page has said since September 9 that affected credit unions would be notified first, before any communication with their members; that answer did not change.
At our 6:04 p.m. check, the earlier answer still stood on the credit-union, individual, preneed, retirement and wealth management outage pages, on the consumer FAQ, and on TruStage Life of Canada's FAQ. TruStage's previous rewrite of this answer began on the same two pages on August 26 and reached every tracked US surface by August 31, so more pages may follow. The preneed, retirement and wealth management pages took only the new stamp in this edit.
A credit union that never got its OpenText registration email may be blocking it in its own mail system, TruStage says; where policy allows, staff can add a rule allowing mail from opentext.com. TruStage also says its policy does not permit sending sensitive data by email.
Between our 12:04 p.m. and 2:05 p.m. Eastern checks on October 6, TruStage added two answers to the OpenText section of its credit union outage page. OpenText is the secure file service where TruStage posts member-level payment files for lending claims (see the September 24 item). The first new answer explains the choice: TruStage says its information-classification and data-handling policy does not approve email for restricted or sensitive data, so files must move by SFTP or another secure transfer service, and it chose OpenText to handle sensitive claims data.
The second answer is for credit union staff who still have no OpenText registration email after trying TruStage's other suggestions, which include checking spam and junk folders. TruStage says the message may be blocked inside the credit union's own Exchange mail system, which TruStage cannot fix; if the credit union's policies permit, staff with access to that system can add a rule allowing mail from opentext.com.
The same edit trimmed the page's opening paragraph. It now calls the July 11 event a cyber attack instead of a cybersecurity attack, splits the paragraph in two, and drops the sentence pointing members to trustage.com/startclaim from that spot. The claim-start address still appears three times further down the page, and TruStage's other outage pages keep the cybersecurity-attack wording. The page carries no “last updated” stamp, so the edit is dated by comparing our captures.
TruStage's claims dashboard now says faxed medical-record information remains unavailable, which continues to affect AD&D claims that need medical records. The same edit removed its last progress statements on GAP claims, including that every pre-outage GAP claim had been processed.
Between our 2:05 p.m. and 4:04 p.m. Eastern checks on October 6, TruStage rewrote three sections of its claims status dashboard. The accidental death and dismemberment note now says faxed medical-record information remains unavailable, which continues to affect AD&D claims that require medical records, and that processing times may be longer than normal. The annuity note adds that claims intake remains available and that TruStage's ability to process and pay claims keeps expanding as capabilities return; the annuity payout row still reads unavailable.
The payment protection note was cut to two sentences: claims for credit insurance, debt protection and GAP can be submitted, and they continue to be accepted, reviewed, processed and paid. Three statements came off: that all pre-outage GAP claims had been processed except those awaiting required information, that TruStage had begun contacting members or credit unions to gather information on post-outage claims, and that teams continue expanding review and payment capacity for claims submitted after July 11. The dashboard was the last surface we track carrying the GAP sentence, after the outage hub and credit union page dropped it on September 25, so no claims-completion statement of any kind now appears on TruStage's outage surfaces. TruStage did not say the GAP statement no longer stands.
No availability label moved. As of that check the only claims figures TruStage still published were on its consumer FAQ, unchanged since September 15; it removed those on October 14. A credit union with a member's AD&D claim that depends on medical records should expect delay; TruStage's service forms page separately says fax is not available.
TruStage's dashboards say BenefitsForYou online access is returning in phases: participants who already had an online account may see some retirement account information after a required password reset. Balances may not yet reflect recent contributions, and the continuity site still says full access is not restored.
Between our 2:05 p.m. and 4:04 p.m. Eastern checks on October 6, TruStage replaced the retirement notes on its policy and contract servicing and disbursements dashboards with the same new paragraph. It says BenefitsForYou online account access is returning through a phased approach, and that participants who previously set up an online account may be able to reach certain retirement account information. Participants must reset their password first. Balances shown reflect market value as of the date displayed and may not yet include recent payroll contributions, related earnings adjustments or other transactions still being processed; TruStage says it is still working through previously submitted transactions and will keep updating account information.
This is the first time since the outage began that TruStage has said participant online access is coming back, but the wording is hedged: phased, limited to existing accounts, and participants “may be able to access certain” information. Neither dashboard gives a sign-in address. At the same check benefitsforyou.com still opened TruStage's retirement continuity site at info.benefitsforyou.com, which still says TruStage is working to restore full BenefitsForYou.com access and sends participants to 800-999-8786 for balances. No availability label moved; the retirement rows remain partially available.
The same edit removed the servicing dashboard's list of what retirement representatives can help with (balance information, loan and distribution support, investment changes, and employer contributions through interim processes) and the disbursements dashboard's statement that periodic benefit payments continue. The continuity site still describes the distribution, loan, contribution, investment and installment-payment processes. The outage hub and credit union page mention the change only as expanding retirement participant access to account information.
For a credit union: a participant who already had a BenefitsForYou login may now be able to use it after a password reset, though TruStage does not say where to sign in, and should treat any balance shown as possibly incomplete. Anyone else still uses the Participant Service Center at 800-999-8786.
Update, October 6 evening: by our 7:58 p.m. Eastern check benefitsforyou.com showed the BenefitsForYou website again, with a participant log-in, instead of the continuity site (item 2026-10-06-benefitsforyou-site-login-returns). TruStage's dashboards still name no sign-in address.
BenefitsForYou.com again opens the BenefitsForYou website, with participant Log in and Register buttons, instead of the continuity site. TruStage has not announced it; its dashboards describe phased access for existing accounts after a password reset. The financial professional portal remains unavailable.
Between our 4:04 p.m. and 7:58 p.m. Eastern checks on October 6, benefitsforyou.com stopped redirecting to TruStage's retirement continuity site at info.benefitsforyou.com, where it had pointed since September 16, and began serving its own page titled “Benefits For You.” Rendered in a browser, the page offers Log in and Register buttons under a “Retirement plan account” heading and lists the Participant Service Center at 800.999.8786. A Financial Professional Portal panel says the service is not currently available and points to the Retirement Solutions resource site.
It is the first time since the outage began that BenefitsForYou.com has shown a log-in. It came a few hours after TruStage's servicing and disbursements dashboards began saying online access is returning in phases for participants who already had an online account, after a required password reset. TruStage has not announced the change on any page this tracker follows. Its dashboards still name no sign-in address, and the continuity site, still online, still says TruStage is working to restore full BenefitsForYou.com access.
This tracker did not try to sign in and cannot say which participants the log-in admits today. The Register button appears even though TruStage's dashboards describe access only for existing accounts. For a credit union: a participant who already had a BenefitsForYou login can try benefitsforyou.com after resetting the password; anyone else still uses the Participant Service Center at 800-999-8786 or participantservicecenter@benefitsforyou.com.
TruStage says teams are starting on the backlog of life insurance surrender requests and are beginning phased issuance of delayed annuity contracts. It still publishes no completion date, and it dropped its only forward-looking window, for more annuity servicing across September and October.
Between our 2:05 p.m. and 4:04 p.m. Eastern checks on October 6, TruStage restamped all three “Latest update” blocks on its outage hub and credit union page “Oct. 6” and rewrote two of them. The policy and contract servicing block now says capabilities continue to become available across life, AD&D, annuity and retirement products, retirement newly named, and that teams are starting to process the backlog of life insurance surrender requests. The disbursements block says capabilities are returning in phases and names the current work: the life surrender backlog, phased issuance of delayed annuity contracts, and wider retirement participant access to account information. A new sentence says recovery remains phased, with backlogs, manual processes and system dependencies still affecting timing, and capabilities varying by product and retirement plan during testing and validation. The claims block's wording did not change.
The servicing and disbursements dashboards carry the same news in more detail. Their life notes tell customers who want to cancel to print and mail the form on the service forms page, to keep expecting delays while the backlog is worked, and that TruStage will honor the date of requests. Their annuity notes drop the month range they had carried since September 18 (more servicing and advisor support returning across September and October on the servicing dashboard, recovery efforts planned through those months on the disbursements dashboard), so TruStage now publishes no forward-looking timing of any kind. The dashboard's annuity numbers, 800-798-5500 for customers and 877-345-4769 for advisors, did not change.
No availability label moved. The credit union page also gained a “Resources for your members” block linking to the claim intake page, the individual consumer FAQs and the life and AD&D service forms page, all pages TruStage already published. The five dated outage pages restamped to October 6, 1:32 p.m. CT with their bodies unchanged.
TruStage does not say which annuity contracts were delayed or when the surrender backlog will clear. A member waiting on either should still expect delay.
TruStage says it will resume processing QDROs (court orders that divide retirement benefits); plan sponsors now submit through the BenefitsForYou Secure Portal instead of email. For Choice Group Variable Annuity and pension plans, it can review unsigned orders but cannot process related transactions or withdrawals.
Between our 12:04 p.m. and 2:04 p.m. Eastern checks on October 5, TruStage added guidance on qualified domestic relations orders to its BenefitsForYou retirement information site. A QDRO is the court order that assigns part of a participant's retirement benefit to a former spouse or other alternate payee. In the section for defined contribution plans that do not use the Choice Group Variable Annuity, TruStage says it will resume processing QDROs. Plan sponsors are to send future requests through the BenefitsForYou Secure Portal in place of the earlier email submission process; after documents are submitted there, follow-up correspondence comes by email from PlanDocuments@trustage.com, and TruStage asks that no secure or personally identifiable information be sent to that address. Participants are told to start the process through their plan administrator, and sponsors can get TruStage's QDRO procedures and model order from their consultant.
Two plan types get less. For defined contribution plans on the Choice Group Variable Annuity and for defined benefit (pension) plans, TruStage says it can review an unsigned domestic relations order, checking a draft for problems before a court signs it, and sponsors send those drafts through the same secure portal. It cannot process any related transactions or withdrawals for those plans at this time.
The same edit adds a Summary Annual Report note for sponsors. Calendar-year plans that filed Form 5500 before July 31, 2026, were to distribute the report to participants by September 30, and TruStage says it emailed instructions to affected plans on September 22; other plans will hear from TruStage before their own distribution deadline. A credit union that sponsors a calendar-year TruStage plan should confirm it received the September 22 email.
The page says TruStage will resume QDRO processing and gives no start date, so this records a stated plan, not a confirmed restoration. The site carries no “last updated” stamp, so the edit is dated by comparing our captures. No other TruStage surface this tracker follows mentions QDROs or the Summary Annual Report.
TruStage split its credit union page answer on policy changes and cancellations. It now says that because of a processing backlog, a member who cancels may be billed once more before coming off the billing file; TruStage will refund that premium and honor the cancellation as of the date received.
Between our 10:05 a.m. and 12:05 p.m. Eastern checks on October 1, TruStage rewrote one answer on trustage.com/outage/business/credit-union. The answer on members who changed or cancelled a policy after their last billing cycle became two. The first now covers policy changes only and says such requests may not yet appear in billing activity and will be honored as of the date received.
The second covers cancellations. It says members who cancel will be removed from automatic recurring billing, but that because of the current processing backlog there may be a gap between receipt of the request and removal from the billing file, and an additional billing attempt could occur in that gap. TruStage says it will refund the premium if that happens, and that cancellations will be honored for the date the request was received.
The refund promise is new on this page; the September 25 servicing dashboard said only that a cancelling member can be taken off automatic billing. A credit union fielding a complaint about a post-cancellation draft can now point to TruStage's stated refund commitment. The page carries no date stamp of its own, so the edit is visible only by comparing captures.
The same sweep showed the shared outage-page stamp moving to October 1, 9:29 a.m. CT on five pages with no body change, and the individual outage page moving its claim-payment-timeline answer from the billing section to the claims section with its wording unchanged.
TruStage restamped its outage hub and credit union page “Sept. 25” and removed their last claims sentence, on pre-outage GAP claims. Its claims dashboard dropped the post-outage payment protection percentages — about 20 percent processed, 50 percent more contacted — with no figure in their place.
Between our 10:04 p.m. Eastern check on September 25 and our 6:04 a.m. check on September 26, TruStage restamped the “Latest update” blocks on its outage hub and credit union page from Sept. 18 to Sept. 25 and rewrote all three. The claims block no longer says that all pre-outage GAP claims have been processed except those awaiting required information; it now carries only a note about enhanced online support resources. The servicing and disbursements blocks carry general statements that capabilities continue to return across life, annuity, retirement and executive benefits, with some requests still manual and slow.
On the claims dashboard the payment protection section lost its percentages: approximately 20 percent of post-outage claims processed and an additional 50 percent contacted to gather information. It now says TruStage has begun contacting members or credit unions for information on post-outage claims. The GAP pre-outage sentence remains there. The life and AD&D sections add that teams are implementing document-access tools to reach beneficiary information and historical claim files, and the Bond Suite section says claim-payment, correspondence and reporting tools continue to be restored.
TruStage did not explain the removals. No availability label moved and no completion date appeared. The consumer FAQ's September 15 totals were not touched.
Update, October 6: the claims dashboard removed both the GAP pre-outage sentence and the statement about contacting members or credit unions on post-outage claims; see the October 6 claims dashboard item.
TruStage's servicing dashboard now says a customer cancelling an eligible life or AD&D policy can be removed from recurring automatic billing while the request is processed, and that request dates will be honored. Cancellation and surrender backlogs remain, and policy changes still cannot be made by phone.
TruStage rewrote the life and AD&D sections of its policy and contract servicing dashboard between our 10:04 p.m. Eastern check on September 25 and our 6:04 a.m. check on September 26. Both now say customers requesting cancellation of eligible policies can be removed from recurring automatic billing while the servicing request is processed. The life section adds that existing cancellation and surrender backlogs remain, that teams have expanded support for those requests, and that customer request dates will be honored even where manual processing slows them.
The mail-in rule stands in shorter form: to change a policy, customers print and mail the form on the outage hub, and TruStage says it cannot make policy changes over the phone. The dashboard also says its individual service hub now has improved navigation and search. The annuity note keeps the September-and-October range for further servicing returns, and the retirement note now says recovery remains focused on restoring participant-account visibility and digital capabilities.
The dashboard does not define which policies are eligible, and TruStage has pulled new guidance back within hours before. A member who has already asked to cancel and is still being drafted should raise it with the Life and AD&D Contact Center.
Update, October 6: TruStage rewrote the life note again. It now says teams are starting to process the backlog of life insurance surrender requests and that TruStage will honor the date of requests; the autobilling sentence remains. The annuity note no longer carries the September-and-October range.
TruStage's disbursements dashboard now says its service team is beginning to process surrender requests for life policies, and tells customers who want to cancel a policy to use the service form on the outage hub. The life rows remain partially available, and manual handling may slow requests.
TruStage rewrote the life section of its disbursements status dashboard between our 8:04 p.m. and 10:04 p.m. Eastern checks on September 25. The note still points customers who need a partial withdrawal, a policy loan or a surrender to the service request forms, but it replaces a general line about progress restoring surrender and policy-servicing capabilities with a direct statement that its service team is beginning to process surrender requests. It adds that customers who wish to cancel their policy should use the service form on the outage hub, and keeps the warning that some transactions may require manual processing and take longer than normal.
The row labels did not move: life one-time withdrawals and surrenders are still marked partially available, as they have been since September 18. The same edit added a line to the annuity note saying some requests may take longer than normal to complete, and removed the “New” tags from the retirement and executive benefits sections without changing their text.
At this check the sentence appeared only on the dashboard; the outage hub and the credit union page were unchanged. TruStage has pulled newly published guidance back within hours before, so read this as the company's current statement, not a settled service level. A member with a pending surrender should still expect manual handling and delay.
Update, October 6: the sentence was rewritten, not withdrawn. Both dashboards, the outage hub and the credit union page now say teams are starting to process the backlog of life insurance surrender requests, and the dashboards add that TruStage will honor the date of requests.
TruStage says it aims to post a member-level payment file in OpenText within three business days after a credit union receives a lending-claims ACH, and OpenText sends no alert when a file arrives, so staff should check it after each ACH.
In the same September 24 edit to its credit union outage page, TruStage added eight FAQ answers about OpenText Core Content, the service it uses to deliver member-level payment files for lending claims. TruStage says it tried to arrange email alerts for new files but OpenText cannot provide them, so credit unions should check OpenText routinely after receiving an ACH; its goal is to post each file within three business days of the ACH. The answers also say data is encrypted in transit and at rest, that a user's ID is the email address TruStage used to set the account up, and that too many wrong passwords trigger a temporary lockout of about 15 minutes. Other answers cover registration trouble, password requirements, session time-outs and missing registration emails, which TruStage says usually land in spam or junk folders.
This is the first time OpenText appears in the incident material this tracker has recorded. The page does not say when credit unions were enrolled or whether every credit union with lending claims will receive access.
TruStage now tells credit unions directly not to submit Plastic Card Policy claims for now and not to email card numbers or other personal information. The filing deadline will be extended by the number of days the hold lasts.
TruStage added the guidance to its credit union outage page between our 12:05 p.m. and 2:05 p.m. Eastern sweeps on September 24. A new notice near the top of the page, marked NEW, asks credit unions not to submit Plastic Card claims at this time, and a new FAQ answer under Other products explains why. Credit unions should hold these claims until further notice and should not send personally identifiable information, including credit card numbers, to TruStage by email. TruStage says it is setting up a secure way to submit these claims and will notify credit unions when it is available. So that policyholders are not penalized by the pause, the time allowed to submit a claim will be extended by the number of days submissions are on hold.
The same guidance first reached this tracker on September 23 through a peer association's resource page, which we logged for staff only because no TruStage surface carried it. TruStage's own page now does, so credit unions can act on it from the source. The page gives no date for the secure process and no revised deadline.
Employers using TruStage's interim payroll upload process should look for a September 18 email from TruStage in addition to the August 19 one; the site does not say what the new email changes.
TruStage edited the payroll answer on its BenefitsForYou information site between our 4 p.m. and 6 p.m. Central checks on September 24. The paragraph describing the interim upload process for defined contribution plans that are not on the Choice Group Variable Annuity previously pointed employers to an August 19 email; it now points to emails sent August 19 and September 18 to the eligible plan types. The rest of the answer is unchanged: payroll files sent in good order through automated aggregators such as PayKonnect and Payroll Integrations continue to process as usual, and the payroll team contacts employers when a file is not in good order or needs funding approval.
The site does not describe the contents of the September 18 email, and this tracker has not seen it. Credit unions that sponsor a TruStage retirement plan and upload payroll directly or through MoveIt should confirm they received it.
TruStage cut roughly 60 percent of its retirement outage page on September 22, moving the interim withdrawal, payroll and investment-change guidance to its Retirement Solutions continuity site. Nothing was withdrawn — every removed block is published at info.benefitsforyou.com, which is now the page to use.
Between this tracker’s 10:05 a.m. and 12:05 p.m. checks on September 22, TruStage rewrote its retirement outage page and moved the shared outage-family stamp to September 22, 10:23 a.m. CT. The extracted text shrank from about 15,800 to 6,400 characters. What remains is a short recovery paragraph, the status line, two new blocks — one saying retirement plan assets were not impacted and remain invested while some online account and transaction capabilities may stay limited, the other directing readers to the Retirement Solutions resource site for balances, contributions, withdrawals, loans, investments, reporting and interim processes — and a much shorter set of FAQs.
The participant FAQ lost its answers on which services are unavailable, on restoring online 401(k) access, on receiving funds from a retirement account, on lost earnings, and on initiating trades or changing investment elections. The plan sponsor FAQ lost more: system-restoration timing, scheduled installments and annuity distributions, benefit statements, plan-level statements through Matrix, payroll processing split by plan type, payroll templates, continuing enrollment, and the link to the Groom Law white paper. Each section keeps the data-investigation answer and gains one combined answer that repeats only that BenefitsForYou.com remains down. The Mandiant containment answer and its memo link survived a third rewrite untouched.
This is a consolidation, not a withdrawal, and we checked it before saying so. Every removed block appears on the Retirement Solutions continuity site at info.benefitsforyou.com, which this tracker has snapshotted since September 16 and which did not change in the same sweep: the Choice Group Variable Annuity payroll restriction and its non-interest-bearing account, the automated payroll and secure-portal routes, the Groom Law paper, the investment trade and allocation change process, and the service-center numbers. Two read more currently there than they did on the outage page — statements are described as monthly and mailed to all participants, and contributions are adjusted to reflect the earnings that would have occurred on the original check date. One route differs enough to pass on: the continuity site tells participants to call 800-999-8786 for a withdrawal or loan form and return it to the plan sponsor for approval and secure-portal upload, where the outage page had pointed them to email. The retired 844-958-8910 marketing number still sits in the page’s call widget.
TruStage rebuilt its individual outage page on September 22: the "Investigating" status and dated stamp are gone, billing answers moved to the top, and the opening now says TruStage has contained the incident. The contact line, 1-800-779-5433, and its hours did not change.
Between this tracker’s 12:05 p.m. and 2:05 p.m. checks on September 22, TruStage restructured trustage.com/outage/individual. The heading that read “TruStage is actively investigating a cybersecurity attack” is now “Services and recovery updates for individuals,” and the block beneath it that showed “Status: Investigating” with a “Last Updated” time is gone entirely. The page no longer carries a dated stamp, so it has left the shared-stamp outage family; the other five dated outage pages still read “Investigating.”
The new opening paragraph says that since the attack was detected TruStage has contained the incident and is rebuilding portions of its infrastructure. TruStage dropped containment language from its outage-page lead copy on August 5, and it has not returned elsewhere: as of this check the individual page is the only outage page whose lead says so. It is TruStage’s own statement, not a new Mandiant finding, and it says nothing about whether data was accessed — the page’s data-investigation answer is unchanged and still says that analysis will take additional time.
The rest is reorganization. Life and AD&D service forms and the claim link now sit at the top, and a new “What to know” section lifts five billing answers — payment options and mail-in payments, restored ACH and card billing, what happens to coverage when a payment cannot be made, past-due notices, and drafted premiums — out of the FAQ list, with their wording unchanged. The separate links to the annuities and Retirement Solutions support pages were removed from the body. The contact line and hours moved to a “Still have questions?” block and did not change: 1-800-779-5433, weekdays 8:00 a.m. to 5:00 p.m. CT and Saturdays 9:00 a.m. to 1:00 p.m. CT, five occurrences as before.
Verified against the live page at this check, not only the snapshot. Nothing here changes service status, coverage, or any number a credit union gives members; it follows the same pattern as the retirement page consolidation this morning.
Annuity contract owners can now request a one-time required minimum distribution, or enroll in automatic RMDs, on an electronically signed form. Until this afternoon the page offered only a printable RMD form to complete and mail.
Between this tracker's 4:05 p.m. and 7:05 p.m. ET checks on September 21, TruStage added an “Annuity RMD form” block to the withdrawal and surrender requests section of its annuity outage page. The page describes it as a way to request a one-time required minimum distribution or enroll in automatic RMD distributions, completed with TruStage's forms partner AssureSign — the same electronic-signature route already used for partial withdrawals, surrenders, direct deposit changes, application cancellations and right-to-examine requests.
One detail is worth passing to staff who field these calls: unlike every neighboring block, which offers separate single-owner and joint-owner versions, the RMD block carries a single link labeled “Required minimum distribution form.” TruStage does not say on the page how jointly owned contracts should use it.
The page already listed a downloadable RMD form lower down, grouped with the systematic withdrawal and direct deposit PDFs; that entry is unchanged. The addition is therefore an electronic path to a request that previously had to be printed, signed and mailed, not a new capability.
The same edit moved the shared “Last Updated” stamp on all six dated outage pages from September 18, 9:01 a.m. CT to September 21, 3:37 p.m. CT. Annuity is the only one of the six whose body changed. Nothing else moved on it: the status still reads “Investigating,” the annuity contact center line is still 855.591.9027 weekdays 8:00 a.m. to 5:00 p.m. CT, and the page still tells customers they may have difficulty accessing account information, completing transactions or submitting requests online. As with the other outage forms, this is a workaround while online servicing is down, and TruStage publishes no turnaround time for requests submitted on it.
Overnight TruStage deleted the life and AD&D claims-count bullet from its outage hub and its credit union outage page, taking the more than $100 million figure with it. Neither summary page now carries a claims total, and both are still stamped “Latest update – Sept. 18.”
TruStage published the figure on the afternoon of September 18, cut it from the outage hub that evening, and has now removed it from the credit union page as well. Our 6:01 p.m. sweep on September 18 still found the credit union page reporting more than 10,000 life and AD&D claims paid, representing more than $100 million in benefits delivered; the 6:45 a.m. sweep on September 19 found the bullet gone from both pages. The same edit removed the credit union page's clause saying recurring disability and unemployment claim backlogs have been cleared — the hub and the claims dashboard had dropped it the evening before — so that sentence is now off every TruStage surface we track. The two sweeps are about twelve hours apart because the September 18 evening checks did not run, so we cannot place the edit more precisely than overnight. Neither page's “Latest update – Sept. 18” stamp moved with it.
What remains in the claims block on both pages is one sentence: all pre-outage GAP claims have been processed except those awaiting required information. No claims total of any kind now appears on the hub or the credit union page. At that check the only claims figures TruStage still published were elsewhere — on its consumer FAQ, untouched since September 15 and removed October 14, over $60 million in Individual Life claims and more than $44 million in lending and property-and-casualty claims paid since the attack; and on its claims dashboard, percentages for payment protection only, roughly 20 percent of post-outage claims processed with the member or the credit union contacted to gather information on an additional 50 percent of that inventory.
The same edit trimmed the policy and contract servicing block on both pages. It removed the sentence listing what support is available — account balance information, loan and distribution support for eligible retirement plans, investment change requests for eligible plans, and select annuity servicing including withdrawals, surrenders, direct deposit updates and application cancellations — and the sentence saying some servicing requests still require interim or manual processes. That detail has not been withdrawn from the site: both statements still appear on the policy servicing and disbursements dashboards. What changed is where the information lives, not whether TruStage stands behind it. The remaining bullet is unchanged and says additional policy-servicing capabilities are being restored through contact-center-supported processes.
For a credit union the practical effect is that a figure a member or a board may have been given on September 18 can no longer be found on the page it came from. It is the third TruStage figure this month to be published and pulled back inside about a day, after the annuity transaction pointers on September 11 and the hub's own narrowing of this same bullet on September 18. Quote TruStage totals with the date and the page you read them on, and re-check the page before repeating them. No availability label moved in this edit, and no completion date returned.
Update, October 6: the dashboards' retirement notes were rewritten, and the list of available retirement support no longer appears on either dashboard. TruStage's retirement continuity site still describes the distribution, loan, contribution, investment and installment-payment processes.
In an evening edit on September 18 the outage hub cut its bullet back to more than 10,000 life, AD&D and pre-planning claims paid — no dollar figure, a wider claim category, and no mention of cleared backlogs — while the credit union page kept the fuller wording, so the two pages disagreed. Both dropped the bullet entirely overnight.
TruStage published new claims figures on its outage hub and its credit union outage page on the afternoon of September 18, and edited the hub again the same evening. After that evening edit the hub bullet read that more than 10,000 life, AD&D and pre-planning claims have been paid. The $100 million in benefits delivered is gone, “pre-planning” has been added to the claim category, and the sentence saying recurring disability and unemployment claim backlogs have been cleared has been dropped. The credit union page was not touched in that second edit and still carries all three.
The claims dashboard was edited alongside the hub. It dropped its own backlogs sentence and re-scoped its post-outage percentages: they now read approximately 20 percent of post-outage claims processed, with the member or the credit union contacted to gather information on an additional 50 percent of the post-outage inventory — previously worded as claims submitted after July 11, and as contact made to file payment on the additional 50 percent.
Both the hub and the credit union page also dropped the sentence added earlier that day saying death claims support is now available as part of retirement and annuity servicing. The capability itself is still described on the annuity outage page and on both the claims and servicing dashboards; what came off is the announcement.
For a credit union answering a member, the practical effect on September 18 was that TruStage's own two summary pages gave different accounts of the same day's progress, neither dated more precisely than “Sept. 18.” Overnight the disagreement resolved by deletion: both pages dropped the bullet, and neither carries a claims total as of the morning of September 19 (see 2026-09-19-trustage-drops-claims-totals-from-summary-pages). Quote a figure with the page and date it came from, and check the page again before repeating it.
On the evening of September 18 the life section of TruStage's disbursements dashboard — its headline, one-time withdrawals and surrenders — changed from unavailable to partially available. It is the first time those rows have moved since TruStage began publishing the dashboards on August 20.
TruStage rewrote its disbursements status dashboard on the afternoon of September 18 (caught at our 6 p.m. check). The life section headline and the one-time withdrawal and surrender rows under it all changed from unavailable to partially available. Every one of the 252 snapshots we have taken of that page since it appeared on August 20 had read unavailable, so this is the first upgrade of those rows in the incident.
The note above them was rewritten with it. Where it had said only that customers needing a partial withdrawal, a policy loan or a surrender can get service request forms, it now adds that teams are making progress restoring surrender and policy-servicing capabilities through contact-center-supported processes while system capabilities continue to be restored, and that some transactions may require manual processing and take longer than normal.
The other sections were reworded without moving their labels. The annuity note adds that recovery efforts planned through September and October are expected to expand support for customers and financial professionals. The retirement note now says participants may request loans, distributions and other eligible plan transactions, and that many participants can obtain account balance information while digital-access capabilities are restored. The executive benefits section gained a “New” tag and a line saying established partner processes remain available.
Read “partially available” as TruStage's own label, not as a promise about any one request: it is the same label GAP and payment protection claims have carried for weeks while processing times ran long. A member who needs a withdrawal, a policy loan or a surrender should still expect manual handling and delay, and the forms route on the individual outage page remains the published path.
TruStage's servicing dashboard now states plainly that contact center representatives cannot update or make policy changes over the phone — customers must get the service request form, sign it and mail it in. The same update adds death claim support to retirement and annuity servicing and a September–October range for more annuity capability.
The life section of TruStage's policy and contract servicing dashboard was rewritten on September 18. It now tells customers who want to change, update or cancel a policy to use the service request form at the link, and says that while representatives can assist with many policy inquiries, they cannot currently update or make policy changes over the phone — customers should access the form, sign it and mail it in. TruStage also says teams continue making progress restoring surrender, cancellation, beneficiary-change and other policy-servicing requests through available support channels.
The annuity row of the same dashboard now says direct-deposit servicing, application cancellation support, withdrawal processing, surrender request processing and annuity death claim support are available through continuity solutions, and that additional annuity servicing and advisor-support capabilities are expected to continue returning through phased recovery efforts underway across September and October. That month range is the first forward-looking timeframe TruStage has published on any surface since it withdrew its mid-September claims target on September 11. It attaches to annuity servicing rather than claims, and it names no specific capability and no date.
The retirement row dropped the flat sentence “Digital access remains unavailable as recovery efforts continue” and now says progress continues toward expanded participant account visibility and digital-access capabilities while some retirement processes remain manual. That is a softening of wording, not an announcement of restoration: TruStage's retirement continuity site still says it is working to restore full BenefitsForYou.com access, and participants still cannot log in.
The outage hub and credit union page carry the roll-up versions of the same update — death claim support now available as part of retirement and annuity servicing, and direct-deposit servicing for annuity customers now available. No availability label moved on any dashboard; the annuity payout row on the claims dashboard still reads unavailable, and the disbursements dashboard headline still reads unavailable.
In an afternoon edit on September 18 TruStage's outage hub and credit union page reported more than 10,000 life and AD&D claims paid, representing more than $100 million in benefits delivered; hours later it cut the figure from the hub, leaving the credit union page the only surface carrying it, and overnight it removed the bullet from that page too. The $44 million pre-outage total it replaces is gone, and so is the September 11 statement that every pre-outage debt protection life and credit life claim had been paid.
On the afternoon of September 18 TruStage restamped its outage hub and its credit union outage page “Latest update – Sept. 18” and rewrote the claims block on both. The new wording says more than 10,000 life and AD&D claims have been paid, representing more than $100 million in benefits delivered, that all pre-outage GAP claims have been processed except for claims awaiting required information, and that recurring disability and unemployment claim backlogs have been cleared.
The claims dashboard was rewritten in the same edit and carries the first post-outage percentages of the incident, in its payment protection section — credit insurance, debt protection and GAP. TruStage says it has processed approximately 20 percent of claims submitted after July 11, and that it has contacted the member or the credit union to gather information needed to pay an additional 50 percent of that post-outage inventory. The life and AD&D sections of the dashboard dropped their dollar figures entirely and now say only that teams continue working through pre-outage and post-outage claims.
Read the new headline figure carefully. The $44 million total it replaces was explicitly pre-outage life and AD&D; the $100 million sentence carries no such qualifier and TruStage does not say what population or period it covers, so it is not a like-for-like increase. Removed in the same edit, from every TruStage surface we track, are the $6.6 million credit insurance and debt protection life figure and the sentence saying those payments accounted for 100 percent of outstanding pre-outage debt protection life and credit life claims — the only completion TruStage had claimed in this incident. Nothing on its surfaces says that completion no longer stands; it simply stopped being published.
The consumer FAQ's separate September 15 totals were not touched: over $60 million in Individual Life claims and more than $44 million in lending and property-and-casualty claims paid since the attack. Those count different work from the hub figure and TruStage nowhere reconciles the two. No claims availability label moved on any dashboard, and no completion date returned.
TruStage edited the hub again the same evening, cutting the $100 million figure and the backlogs sentence from it while leaving the credit union page as published. That second edit is recorded separately in 2026-09-18-trustage-hub-narrows-claims-figures. Overnight it removed the bullet from the credit union page as well, so none of the figures described here survives on a TruStage summary page; see 2026-09-19-trustage-drops-claims-totals-from-summary-pages.
TruStage replaced the August direct-mail answer on its credit union outage page this morning: direct mail and email marketing for AD&D, Life and Auto Insurance products is now paused through November. Sales are not paused — auto and home still runs through Liberty Mutual and Polly — but new mailed offers stop.
Between this tracker's 10:00 a.m. and 12:00 p.m. Eastern sweeps on September 17, TruStage swapped out the marketing answer on trustage.com/outage/business/credit-union, the page written for credit unions. The question that had asked whether the call center could fulfill leads from August direct mail is gone, and with it the answer saying TruStage planned to mail only Auto Insurance offers that month. In its place is a broader question about whether TruStage is marketing Consumer Insurance by direct mail or email at all.
The new answer sets a date for the first time: direct mail and email marketing for AD&D, Life and Auto Insurance products is paused through November. TruStage says future marketing activity is being evaluated as part of its recovery and resiliency work, weighed against member experience, operational readiness and business continuity, and that members may still see marketing already distributed through the credit union channel — website banners, branch materials, brochures and other collateral. No restart date is given beyond the November boundary, and TruStage does not say whether "through November" means the pause lifts at the start of December or is simply the horizon it will commit to.
What a credit union should not read into this: the products themselves are not paused. The adjacent answer on the same page is unchanged and still says members can get Auto & Home quotes, buy coverage, have policies serviced and reach claims support through the Liberty Mutual and Polly partnership without disruption. What stops is outbound acquisition marketing, and with it the flow of leads a credit union might have planned around this fall.
One consequence is visible on the page itself and worth raising with staff. TruStage's route to a new AD&D, Simple Issue Term or Simple Issue Whole Life policy is still the paper application inside a TruStage direct mail offer — that answer is unchanged, and it says explicitly that these policies cannot be started through the call center or on TruStage.com. With AD&D and life direct mail now paused, a member who has not already received a mailing has no published way to apply for those products. TruStage has not addressed that combination anywhere this tracker sweeps.
In the same edit the credit union page picked up the three claims-pacing answers TruStage added to its individual outage page on the afternoon of September 16 — why it cannot give claim-specific payment timelines, why some claims move faster than others, and why it asks for more information after a claim is filed. The wording matches the individual page exactly; this is the usual page-by-page rollout rather than new content. The older line saying product-specific claim payment timelines are not available still stands above it on this page and on the consumer FAQ. The credit union page remains undated, so nothing on it signals that any of this changed; the six dated outage pages moved their shared stamp to September 17 at 9:33 a.m. CT with their bodies untouched.
The new BenefitsForYou site adds retirement guidance absent from TruStage's outage pages: monthly mailed statements starting with the 8/31/2026 month-end, no new pension benefit calculations or payment requests, and 2026 required minimum distributions not due until December 31.
Statements first, because it is the answer a plan sponsor is most likely to be asked about. For defined contribution plans recordkept on Matrix — 401(k), 403(b), governmental and tax-exempt 457(b) and deferred compensation plans, meaning those not using TruStage's Choice Group Variable Annuity — statements are being processed and mailed to every participant, including those who had elected electronic delivery, and TruStage says it will send monthly statements by mail instead of quarterly to participants and sponsors beginning with the 8/31/2026 month-end. For defined contribution plans that do use the Choice Group Variable Annuity, the 6/30/2026 statements were mailed to all participants with a balance on file and TruStage says it is working to restore normal statement processing. TruStage's retirement outage page still describes quarterly statements mailing on the normal schedule for most plans; the monthly cadence appears only on the new site.
The site also addresses a plan type the outage page does not. For defined benefit and pension plans, monthly annuity and installment payments established before July 2026 are being paid, but TruStage says it cannot process new benefit calculation or payment requests and will give an update when that service is available. Pension assets are described as secure and still invested, and participant benefit statement processing will resume at a later date. The phrase “defined benefit” appears on no TruStage page this tracker follows, so a credit union sponsoring or referring a pension plan had no published TruStage answer before today.
On required minimum distributions, RMD-age participants with annuity or installment payments already established keep receiving them on the normal schedule, and third-party administrators and RMD-age participants in plans that can use the interim withdrawal process may request distributions through it. For plans that cannot, TruStage notes that any remaining 2026 required minimum distributions are not due until December 31, 2026, and says that as the deadline approaches it or the plan's TPA will contact RMD-age participants who still owe one and will process the distribution automatically if the participant makes no election. On plan reporting: Form 5500 preparation and filing continues, TruStage files Form 5558 as usual to extend Form 5500 deadlines by two and a half months and will post a copy once BenefitsForYou is available, the Auditor's Toolbox reaches audited plans and TPAs through a secure portal with instructions emailed to affected plans, and administrators of Matrix-recordkept plans sign Form 5500 by logging in to the Relius Government Forms site. None of Form 5558, the Auditor's Toolbox or Relius appears on any other TruStage surface tracked here.
Two cautions on how to use this. The site carries no “last updated” stamp and no dated news section, so these answers can be dated no more precisely than the day they first appeared, and a later edit will be visible only as a difference from today's snapshot. Much of the rest of the site restates guidance already published on the retirement outage page — the interim withdrawal and investment-change processes, the payroll split between Matrix-recordkept and Choice Group Variable Annuity plans, and the Groom Law white paper on delayed payroll submissions — and this item records only what is new.
TruStage repointed BenefitsForYou.com to a continuity site, info.benefitsforyou.com, on September 16; participants could not log in there. On the evening of October 6 BenefitsForYou.com began showing a participant log-in again, and the continuity site stayed online.
This tracker has watched where benefitsforyou.com resolves since August 18, because the redirect is the cleanest available tripwire for the retirement portal coming back. On all 255 checks before today it returned TruStage's retirement outage page. Between the 7:56 a.m. and 11:45 a.m. sweeps on September 16 it changed for the first time: the domain now resolves to info.benefitsforyou.com, a site titled “Retirement solutions.” TruStage announced the move on none of the pages this tracker follows, and the retirement outage page itself is byte-identical to this morning.
The new site is a continuity guide rather than an account portal. A visitor first picks a plan type — defined contribution covering 401(k), 403(b) and 457(b) plans, or defined benefit and pension — then a role, either sponsor, financial professional or third-party administrator, or participant. Each combination opens topic answers on balances, contributions, withdrawals, investments, reporting, contacting TruStage, and website status. The contact block gives the Retirement Service Center at 844-999-2677 and retirementservicecenter@benefitsforyou.com for sponsors and TPAs, and the Participant Service Center at 800-999-8786 and participantservicecenter@benefitsforyou.com for participants, both Monday through Friday, 8:00 a.m. to 5:00 p.m. CT, with a warning that waits may run longer than usual. Both numbers already appear on TruStage's retirement outage page and its policy-servicing dashboard, so a credit union that recorded them has nothing to change.
Read the change carefully before repeating it to anyone. The site's own website-status answer says TruStage is still working to restore full BenefitsForYou.com access. Its only portal link, portal.benefitsforyou.com, is described as the route by which participants in TruStage's Pooled Employer Plan submit a completed interim withdrawal or loan form — document submission, not account access. TruStage's policy-servicing dashboard, fetched in the same sweep and unchanged, still states that digital access remains unavailable as recovery continues. The service board on this page therefore keeps retirement plan servicing at disrupted.
What a credit union should take from it: staff or members who reach BenefitsForYou.com now land on a different page than they did this morning, and the guidance there is sorted by plan type in a way the outage page is not. The retirement outage page at trustage.com/outage/retirement is unchanged and still the dated official surface. This tracker now snapshots the new site every sweep, so a further change — including the login surface the watcher was built to catch — is reported rather than inferred.
Update, October 6: TruStage's servicing and disbursements dashboards began saying BenefitsForYou online access is returning in phases for participants who already had an online account, after a password reset. benefitsforyou.com still opened the continuity site at that check, and the site still said full access was not restored.
Update, October 6 evening: by our 7:58 p.m. Eastern check benefitsforyou.com no longer opened the continuity site. It served the BenefitsForYou website with participant log-in and registration buttons (item 2026-10-06-benefitsforyou-site-login-returns). The continuity site remains online at info.benefitsforyou.com.
TruStage replaced 855-591-9026 with 1-800-779-5433 on its individual service-forms page this afternoon, one day after making the same change on the individual outage page. Credit unions that kept the old number because this page still carried it should now correct it.
Between this tracker's 11:45 a.m. and 4:18 p.m. Eastern checks on September 16, the telephone number on trustage.com/outage/individual/service-forms changed from 855-591-9026 to 1-800-779-5433 in all four places a reader sees it — twice in the page header and twice in the “Give us a call” block at the foot. All four click-to-call links were re-pointed with it, and 855-591-9026 survives on the page only inside the site-wide schema.org contact markup, which is not offered to a reader as a number to dial. Nothing else on the page moved: the mail-in instructions, the AD&D service request and beneficiary change forms, and the notice that fax is unavailable are byte-identical to this morning.
This closes a split this tracker flagged on September 15. TruStage swapped the individual outage page to its Life and AD&D Contact Center number that afternoon but left this sub-page on the old one, so both numbers stood on TruStage's own pages for a day. Across the TruStage surfaces this tracker sweeps, 855-591-9026 now appears in reader-facing copy on one page only, the variable universal life FAQ, where it occurs three times. The new number stands on three: the individual outage page, this service-forms page, and the policy and contract servicing dashboard.
Two cautions on reading the number here. This page carries no outage contact paragraph and no “Last Updated” stamp, so the number is the page's templated header and call-widget line rather than a dated instruction about the outage, and the change can be dated no more precisely than the window above. The hours printed beneath it — Monday to Friday, 7:00 a.m. to 9:00 p.m. CT, Saturday 8:00 a.m. to 4:00 p.m. CT — belong to TruStage's general licensed-agent widget, not to the outage line. The outage hours TruStage publishes for this number are on the individual outage page: weekdays 8:00 a.m. to 5:00 p.m. CT and Saturdays 9:00 a.m. to 1:00 p.m. CT. A credit union pointing members here should quote those.
TruStage announced the change on none of the pages this tracker follows. The six dated outage pages re-stamped to September 16, 2:12 p.m. CT in the same window with their bodies untouched.
TruStage added three claims questions to its individual outage page this afternoon — why it will not give claim-specific payment timelines, why some claims move faster than others, and why it requests more information after a claim is filed. It is the first published explanation of claim pacing, not a change in service.
Between this tracker's 4:18 p.m. and 6:00 p.m. Eastern checks on September 16, three question-and-answer blocks appeared on trustage.com/outage/individual. One sits under Billing and payments — why TruStage cannot provide claim payment timelines — and two under Claims: why some claims are moving more quickly than others, and why TruStage asks for more information after a claim has already been submitted. Nothing was removed and no other line on the page moved; a set comparison of the two snapshots shows the three blocks as pure additions.
The answers are explanatory rather than operational. On timelines, TruStage says that even under normal operations some individual claims are more complex and need different levels of review, documentation, validation or investigation, and that because of those differences it cannot give claim-specific payment timelines. On pacing, it says product, claim type, documentation requirements and processing capability all affect how a claim moves through review and payment. On follow-up requests, it says some claims need additional information before they can move into review and adjudication, and that collecting complete information and validating coverage helps claims be processed accurately.
All three questions and all three answers are new to every TruStage surface this tracker follows — none appears in any snapshot taken since July. The older sentence saying product-specific claim payment timelines are not available is a different line and still stands on the consumer FAQ and the credit union outage page; the new answer gives a reason where that line gave none. Nothing here is a date, a total, or a restored capability, and no availability label moved.
One dating caution. The page's stamp still reads September 16, 2026, 2:12 p.m. CT, the value it carried at the 4:18 p.m. check, so TruStage published this content without advancing the stamp. The change can be dated no more precisely than the window between the two checks.
A sentence added to the credit union and individual outage pages says customers can report a claim online, supply claim information or get guidance on next steps — and should not file a duplicate if a claim is already in. Useful at the front line.
TruStage added the same guidance to its claims answers on trustage.com/outage/business/credit-union and trustage.com/outage/individual in this afternoon's edit: customers can report a new claim online, provide claim-related information or receive guidance on next steps, and should not file a duplicate claim if one has already been submitted. The wording differs only in person between the two pages.
The instruction is small but it is the first time TruStage has told customers plainly not to resubmit, and it is the question a credit union is most likely to be asked by a member who filed weeks ago and has heard nothing. The backlog language around it is unchanged — claims remain a priority, TruStage continues working through backlogs, and it still publishes no date for finishing them.
What the sentence does not do is give anyone a way to check on a claim already filed. TruStage's representatives still cannot see individual account information on these pages' own account, so a member who wants status has no self-service route; the practical advice remains to log the inquiry and follow it until the claim is actually paid.
TruStage now says “certain recurring” credit card billing has resumed for some Life, AD&D and Preplanning customers — a narrower claim than the one it made before. It also states that one-time payments by phone and certain paper billing remain unavailable, and that grace-period accommodations stand.
Three payment answers on trustage.com/outage/business/credit-union changed in this afternoon's edit, and one of them narrows a capability TruStage had already claimed. The billing-restoration answer previously said recurring monthly ACH and, most recently, credit card billing had resumed for certain Life, AD&D and Preplanning customers. It now says recurring monthly ACH and certain recurring credit card billing have resumed for those customers. The qualifier is new, and it does the work: card billing is no longer described as resumed as a class, only in part, and TruStage does not say which cards or customers are inside the part that works.
The answer explaining why an August premium may have drafted when July's did not was tightened in the same direction, from billings that are beginning to resume to billing that is resuming. Neither edit changes what a member should do, but both change what a credit union can safely tell one — if you have been saying card billing is back, say some of it is.
The third answer gains detail rather than losing it. Where TruStage previously said only that some payment processing had been restored and some options remained limited, it now adds that members may use available payment options or mail a payment following the instructions on the outage hub, that one-time payments by phone and certain paper-billing functions are still unavailable, and that coverage protections and grace-period accommodations remain in place. That last clause is the reassurance to lead with at the counter; the mail route is the workaround this tracker recorded on September 10, when TruStage published its lockbox addresses.
The page carries no date stamp of its own, so the edit is visible only by comparison with the previous capture.
The recovery-posture sentence TruStage first used on one page September 11 is now on four: it was appended word for word to the credit union and individual outage pages on September 15. It still carries no dates, volumes or product scope.
TruStage extended the “When will this be resolved?” answer on trustage.com/outage/business/credit-union and trustage.com/outage/individual in this afternoon's edit. The existing paragraph is untouched — phased recovery, a broad portion of the technology environment affected, systems restored carefully, some capabilities needing more time. Appended to it, word for word, is the sentence that appeared on the wealth management solutions page on September 11 and on the general business page on September 14: that recovery is increasingly moving from access to execution, with more customers and members reaching TruStage, more claims moving through the process and more transactions being completed, and that some services continue to rely on interim or manual processes.
The propagation is the news, not the words. A characterization that sat on one page for three days is now on four, including the two pages a credit union and its members are most likely to read, which is the shape TruStage's language takes once it becomes the company's standard description rather than a trial.
The caveat travels in the same sentence and remains the operative half for a credit union: interim and manual processes are still in use, and those are what turnaround times and error rates depend on. The sentence names no volume, no completion target and no service that has moved from one state to the other, so it cannot be used to tell a member that a particular capability now works. TruStage's three service status dashboards remain the concrete reference for that.
At this check the sentence is on the wealth management solutions, business, credit union and individual pages; the annuity, preplanning and retirement answers still end at the older wording.
TruStage's credit union outage page now carries the rewritten containment answer: Mandiant updated its August 27 memo, and on that investigation found no evidence of threat actor activity in the affected environments since July 11. Preplanning, then the last US outage page on the older wording, took the rewrite the same evening.
TruStage rewrote the containment answer on trustage.com/outage/business/credit-union in an edit captured at this tracker's 4:01 p.m. Eastern check. The question is unchanged — whether a cybersecurity expert has spoken to containment and to whether TruStage is operating in a clean, safe environment as systems return. The answer now says Mandiant updated its Investigation Memo on August 27 to reflect the latest forensic evidence it reviewed, and that on the basis of its investigation Mandiant found no evidence of threat actor activity in the affected environments since July 11, when TruStage identified the incident and acted to contain and remediate it.
This is the credit union–facing page, so the wording matters more here than on the product pages that took it first. The construction is the same one TruStage rolled onto the annuity, business and wealth management pages between September 14 and 15: it reports an absence of evidence within a defined investigation, and it attributes the containment action to TruStage rather than having Mandiant certify the environment. The earlier answer on this page made the same point in narrower terms and pointed the reader to the memo; the affirmative formulation that TruStage used in early September — that the environment was clean and the incident contained — is now off every US outage page and survives only on the Canadian FAQ.
The practical reading for a credit union is unchanged by the rewrite, and that is the point worth passing on: no evidence of activity within the scope of an investigation is not a statement that no data was accessed, and TruStage continues to call conclusions on that question premature. The memo is still the only inspectable document behind the claim, and it does not define its own scope.
With this edit the preplanning page was the only US outage page still carrying the September 3 wording, and it took the rewrite itself that evening — see the September 15 preplanning item. At that check the retirement page carried an older answer again, which named Mandiant and linked the memo without a finding; it took Mandiant's October 9 wording on October 27. Page lists in this record are re-checked every cycle while the rollout is in flight.
TruStage replaced 855-591-9026 with 1-800-779-5433 on its individual outage page this afternoon, in every place a reader can see. Published hours did not change. Correct the number anywhere you have posted it. The service forms sub-page, which still showed the old number at this check, took the same swap on September 16.
Between this tracker's 2:01 p.m. and 4:01 p.m. Eastern checks on September 15, TruStage changed the telephone number on trustage.com/outage/individual and re-stamped the page September 15, 1:42 p.m. Central. The contact sentence now tells individual policyholders to call 800-779-5433; since September 2 it had read 855-591-9026. The swap is thorough rather than partial: the visible copy, the “Give us a call” block lower on the page and all five click-to-call links now carry the new number, and 855-591-9026 survives only inside the page's schema.org contact markup, which is not offered to a reader as a number to dial.
Nothing else in the paragraph moved. The published hours are still weekdays 8:00 a.m. to 5:00 p.m. Central and Saturday 9:00 a.m. to 1:00 p.m. Central, and the page still says representatives have very limited access to account information and cannot process transactions or submit requests.
The new number is not new to TruStage. It is the Life and AD&D Contact Center line that TruStage's policy and contract servicing dashboard has published since August 27, and that dashboard still carries it, unchanged in this sweep. What has changed is which number the incident-specific page for individual policyholders sends people to — from a line opened for the outage to the standing servicing line. TruStage has not said why, and this tracker is not inferring a reason.
Two cautions before you update your own material. The swap has not reached TruStage's other individual-facing surfaces: the service forms sub-page at trustage.com/outage/individual/service-forms and the variable universal life product FAQ both still publish 855-591-9026, so two different numbers are live on TruStage pages for the same audience as of this check. And TruStage announced none of it — no newsroom release accompanied the edit, and the page's own stamp is the only public marker. We cannot test whether the old line still answers, so treat 800-779-5433 as the number TruStage now publishes for individual policyholders, not as proof the old one is dead.
From September 15 to October 14 TruStage's consumer FAQ reported over $60 million in Individual Life claims and more than $44 million in lending and property-and-casualty claims paid since the attack; it removed both on October 14. Its dashboards separately reported $44 million in pre-outage life and AD&D claims — a different count, not an addable one.
Removed October 14. TruStage deleted both totals from the consumer FAQ that afternoon without explanation (see the October 14 item). What follows is the record of what the FAQ said from September 15.
TruStage rewrote the two claims answers on its consumer service-disruption FAQ at engage.trustage.com in an edit this tracker captured at its 10:01 p.m. Eastern check. The substantive addition is a sentence of figures: since the cybersecurity attack, over $60 million in Individual Life claims and more than $44 million in lending and property-and-casualty claims have been paid. This is the first time either category has appeared on a TruStage-owned surface. Both numbers were previously visible only through a peer association — CrossState's September 9 rewrite relayed them as more than $36 million in Individual Life and more than $33 million in lending and property and casualty, which our record logged for staff only because no TruStage page carried them. TruStage now does, and both have risen substantially in the six days since.
The figure a credit union is most likely to trip over is $44 million, because it now means two different things on TruStage's own pages. On the consumer FAQ it is lending and property-and-casualty claims. On the outage hub, the credit union outage page and the claims status dashboard it is pre-outage Life and AD&D claims — wording all three still carried unchanged at that check. These are separate cuts of separate work and TruStage does not reconcile them anywhere it publishes. Do not add the totals together, and check which page a figure came from before quoting it to a member or a board.
The same edit moved three other things. TruStage now says review of GAP claims submitted after July 11 has begun — language it deleted from its claims dashboard on September 11, returning here on the consumer FAQ only; the dashboard still does not carry it. The sentence saying Life and AD&D processing would take claims pending at the time of the outage before claims received afterward is gone from this page, though the credit union outage page kept that ordering until October 15. And the claims answer took the duplicate-claim guidance TruStage added to the credit union and individual pages earlier the same day: report a new claim online, and do not file a second one if a claim is already in.
Nothing here is a completion date. TruStage still says product-specific claim payment timelines are not available, still says some claims may need additional documentation or manual processing, and has published no date for finishing any claim since September 11. Read the totals as progress. One verification note worth carrying: the page's own “Last Updated” line did not move with this edit — it still reads September 15, 11:15 a.m. Central, the value it carried six hours earlier — so the stamp is not a reliable signal that the content changed.
TruStage's preplanning outage page now carries the rewritten containment answer: Mandiant updated its memo on August 27 and, on that investigation, found no evidence of threat actor activity in the affected environments since July 11. It was the last US page on the older wording.
TruStage rewrote the containment answer on trustage.com/outage/preneed in the same evening edit that changed its consumer FAQ. The question is unchanged — whether a cybersecurity expert has addressed containment and whether TruStage is operating in a clean, safe environment as systems return to service. The answer now says Mandiant updated its Investigation Memo on August 27 to reflect the latest forensic evidence it reviewed, and that on the basis of its investigation Mandiant found no evidence of threat actor activity in the affected environments since July 11, when TruStage identified the incident and acted to contain and remediate it.
This completes a rollout our record has been tracking page by page since September 2. Five US outage pages now carry the rewritten answer: annuity, business, wealth management solutions, credit union and preplanning. The retirement page carries an older answer again, which names Mandiant and links the memo without stating a finding, and the individual page carries no Mandiant answer at all. The affirmative formulation TruStage used briefly in early September — that the operating environment was clean and the incident contained — is off every US page and survives only on the Canadian preplanning FAQ.
The practical reading for a credit union does not change with the wording, and that is the part worth passing on. No evidence of threat actor activity within the scope of an investigation is not a finding that no data was accessed, and TruStage's own answer on the data question, which sits directly above this one on the same page, still says the forensic and data-impact analysis is continuing and is expected to take additional time. The memo remains the only inspectable document behind the claim, and it does not define its own scope.
TruStage's preplanning page now tells US funeral homes to submit the initial notification of loss to begin a claim, and says beneficiaries may also submit one. Two answers were added: payment options remain limited with no bill or past-due total, and any customer notification depends on the Mandiant and Epiq Global investigation.
The same evening edit replaced the claim-filing answer on trustage.com/outage/preneed. Where the page had carried the generic individual-coverage wording used across TruStage's outage family — that a claim would be processed and paid under applicable policy terms as capabilities were restored — it now names who starts the claim: US funeral homes should submit the initial notification of loss, with a link to do so, and beneficiaries can also submit a notification of loss. TruStage adds that some claim processing limitations will remain in place while it recovers its servicing systems. For a credit union fielding a preplanning question this is a more useful answer than the one it replaced, because it routes the first step rather than describing a policy.
Two answers were appended below. The first says payment options remain limited, online one-time payments are unavailable, and TruStage is unable to mail bills or provide a total past-due balance — while repeating that coverage will not be lost over an inability to pay during the disruption and that more than one premium may come due during the extended grace period. That answer already sat on the individual outage page; this is its propagation to preplanning, not new guidance.
The second is new to this page and names both investigating firms: the investigation remains ongoing, supported by Mandiant and Epiq Global, and if TruStage determines that customer, employee or other affected data has been impacted its intent is to work with partners on any communication needed, supporting them through notification or reporting requirements. Until September 15 the credit union outage page was the only TruStage-owned page naming Epiq Global; preplanning is the second. The substance is unchanged from what TruStage has said since August — partners would be told first, and no determination has been announced — but a credit union asked whether members will be notified directly can now point at a consumer-facing page for the answer rather than a partner one.
The recovery-posture sentence TruStage put on one page on September 11 — recovery moving from access to execution, with the caveat that some services still run on interim or manual processes — was added to the general business outage page on September 14. It names no dates or volumes.
In the same evening edit that rewrote its containment answer, TruStage extended the “When will this be resolved?” answer on trustage.com/outage/business. The existing paragraph is untouched: phased recovery, a broad portion of the technology environment affected, systems restored carefully, some capabilities needing more time. Appended to it, word for word, is the sentence that appeared on the wealth management solutions page on September 11 — that recovery is increasingly moving “from access to execution,” with more customers and members reaching TruStage, more claims moving through the process and more transactions being completed, and that some services continue to rely on interim or manual processes.
The significance is the propagation, not the words. Until now this was a single-page characterization, which is the shape TruStage language takes when it is being tried out; a second page suggests it is becoming the company's standard description of where recovery stands. The caveat travels in the same sentence and is the operative half for a credit union: interim and manual processes are still in use, which is what turnaround times and error rates depend on.
What the sentence still does not carry is any number, date or product scope. It names no volumes, no completion target and no service that has moved from one state to the other, so it cannot be used to tell a member that a specific capability is now working. TruStage's three service status dashboards remain the concrete reference for that. At the time of this check the sentence was on the wealth management solutions and business pages only.
Update, September 15: it propagated again the following afternoon, to the credit union and individual pages. The annuity, preplanning and retirement answers still end at the older wording. See the September 15 entry.
TruStage removed the affirmative Mandiant finding from its wealth management solutions page on the evening of September 14, three days after publishing it there, leaving it on no US outage page. It returned on October 27, citing Mandiant's October 9 memo.
Between this tracker's 4:01 p.m. and 7:50 p.m. checks on September 14, TruStage rewrote the containment answer on two more outage pages. On trustage.com/outage/business/wealth-management-solutions the affirmative sentence reporting that Mandiant found TruStage's “operating environment is clean, the incident is contained” and saw no indication of active intrusion is gone; on trustage.com/outage/business the narrower September 3 answer is gone. Both now carry the wording the annuity page took earlier the same afternoon: that Mandiant updated its investigation memo on August 27 to reflect the forensic evidence reviewed, and found no evidence of threat-actor activity in the affected environments since July 11, 2026, the date TruStage says it identified the incident and acted to contain and remediate it.
The wealth management solutions page was the last US outage page carrying the affirmative finding. Checked page by page against the live pages at this sweep, that sentence now appears zero times anywhere on trustage.com. It published on the annuity page on September 11, spread to wealth management solutions the same afternoon, and was withdrawn from both within three days. The strongest public statement that the incident is over has been taken back off the site. At that check it survived on the Canadian affiliate's FAQ at trustage.ca, where TruStage had stated the clean-and-contained conclusion in its own voice since August 24 — a different company statement on a different regulator's turf, and not a substitute for a US page.
Three answers to the same question were live across the outage family at that check. The annuity, business and wealth management solutions pages carry the new no-evidence wording. The credit union and preplanning pages carry the September 3 wording, which reports that Mandiant has not identified any threat-actor activity within the environments in the scope of its investigation and points to the memo dated August 27. The retirement page still carried the oldest version, which opened with an affirmative yes and linked an undated memo, and the individual page carried no Mandiant answer at all. The page that matters most to our members is the credit union page, and it is not one of the three that moved.
Two notes for anyone checking these pages directly. The outage family's shared “Last Updated” stamp did not move for this edit: all six dated pages still read September 14, 1:33 p.m. Central, the value set in the afternoon edit hours earlier. That is the second time in four days a body change has landed without moving the stamp, so the stamp cannot be used to tell whether a page has been edited. And the memo reference was respelled rather than dropped — the business page previously printed the memo as dated August 27 and now says the memo was updated on August 27. The date is the same and remains the only version marker TruStage publishes, because the link behind it is an undated short URL.
For a credit union nothing here changes service status, member guidance or any contact detail. It matters because this is the answer a member, a board or an examiner is most likely to be shown when they ask whether the incident is over. Anyone who quoted the clean-and-contained sentence from either page should check the page again before repeating it. TruStage has not said why the wording changed, and this tracker is not inferring a reason.
Update, September 15: the credit union page moved off the September 3 wording that afternoon and took the rewritten “no evidence” answer, leaving preplanning as the only US outage page still on the older construction. The finding recorded above is unaffected — no US page carried the affirmative clean-and-contained sentence from September 14 until October 27. See the September 15 entry.
Update, October 27: the affirmative wording returned, citing Mandiant's October 9 memo, on the credit union, annuity and preneed outage pages that afternoon and on the business, wealth management solutions and retirement pages by early evening; see the October 27 entries. The Canadian FAQ was taken down the same day.
TruStage's annuity outage page no longer reports Mandiant finding the environment clean and the incident contained. A third rewrite says only that Mandiant found no evidence of threat-actor activity since July 11. The wealth management solutions page followed the same evening.
Between this tracker's 2:01 p.m. and 4:01 p.m. checks on September 14, TruStage rewrote the containment answer on trustage.com/outage/annuity for the third time in twelve days. The question above it is unchanged and still asks whether a cybersecurity expert has provided information on whether the incident is contained and whether TruStage is operating in a clean and safe environment. The answer the page carried from September 11 until this afternoon reported an affirmative finding attributed to Mandiant — that the “operating environment is clean, the incident is contained” and no active intrusion was indicated. That sentence is gone. Checked against the live page, the withdrawn wording now appears zero times.
What replaced it is narrower on three counts, and the differences are the substance of the change. TruStage now opens by saying Mandiant updated its investigation memo on August 27 to reflect the forensic evidence reviewed, then reports that Mandiant found no evidence of threat-actor activity in the affected environments since July 11, 2026 — the date TruStage says it identified the incident and acted to contain and remediate it. First, a finding of no evidence is not the same statement as a finding that the environment is clean. Second, containment now appears as a description of what TruStage itself did in July, not as a conclusion Mandiant reached. Third, the scope phrase changed: earlier wording confined the finding to the environments within the scope of Mandiant's investigation, and the new sentence refers instead to the affected environments, a boundary TruStage has not defined publicly. The link to the memo survives; it is anchored on the memo's name and still points at TruStage's undated short URL, so the printed August 27 date remains the only version marker.
The outage family now carries four different answers to the same question, each verified against the live pages at this check. The wealth management solutions page was then the only US outage page still reporting the affirmative clean-and-contained finding. The business, credit union and preplanning pages carry the narrower September 3 wording with the August 27 memo reference. The retirement page still carried the oldest version, which opened with an affirmative yes and linked an undated memo. The annuity page now carries this fourth wording, and the individual page carries no Mandiant answer at all. The Canadian affiliate's FAQ at trustage.ca continues to state the clean-and-contained conclusion in TruStage's own voice, as it has since August 24.
For a credit union nothing here changes service status, member guidance, or any contact detail. It matters because this is the answer a member, a board or an examiner is most likely to be shown when they ask whether the incident is over, and the strongest version of it has now been pulled off the page that first carried it. Anyone who quoted the annuity page's clean-and-contained sentence since Thursday should check the page again before repeating it. TruStage has not said why the wording changed, and this tracker is not inferring a reason. One method note: unlike the September 11 reversal on the same page, this edit did move the outage family's shared “Last Updated” stamp, which rolled to September 14, 1:33 p.m. Central — five of the six dated pages took that stamp and nothing else.
Update, later on September 14: the page counts above held for about four hours. Between this tracker's 4:01 p.m. and 7:50 p.m. checks TruStage put this same new wording on the wealth management solutions page, which had been the last US outage page carrying the affirmative finding, and on the general business page, which had been on the September 3 wording. Three US outage pages now carry the new wording, the credit union and preplanning pages carry the September 3 wording, retirement carries the oldest version and individual carries no Mandiant answer. See the later September 14 entry.
TruStage quietly edited one sentence on its outage hub and credit union page: the disbursements roll-up now reads that disbursement capabilities continue to expand, dropping “across Life.” No new capability was named, the block is still dated September 11, and the disbursements dashboard still reads unavailable.
On September 11 TruStage rewrote the disbursements roll-up on its outage hub and credit union page to say that disbursement capabilities continue to expand across Life. At our 10:01 a.m. Eastern sweep on September 14 the hub had dropped the last two words; the credit union page still carried them, and a re-check two minutes later showed it had taken the same edit. That one line was the only difference on either page — the credit union page was otherwise identical to the previous snapshot.
Removing a line-of-business qualifier widens the sentence back into a general statement about disbursements, but TruStage named no newly restored capability, made no announcement, and did not re-date the block, which still reads “Latest update – Sept. 11.” The two bullets under it — retirement loan and distribution requests and periodic benefit payments, and annuity withdrawal, surrender and lifetime income options — are unchanged word for word.
One reading is worth noting, as our own wording, not TruStage’s: the Life-scoped version was the harder of the two to square with TruStage’s own disbursements dashboard, which marks life one-time withdrawals and surrenders unavailable while showing annuity one-time withdrawals, recurring withdrawals and surrenders available. Dropping the qualifier removes that specific tension without changing anything on the board.
For a credit union this is wording, not restoration. The disbursements dashboard headline still reads unavailable, and the gap between the roll-up sentence and the per-product board that we flagged on September 11 is unchanged. Read the dashboard, not the roll-up, when a specific transaction is at stake.
On TruStage's servicing dashboard, mechanical repair coverage went from available to partially available on September 11 — the section pill and both of its function rows. Its own description still says servicing remains available through Assurant. Mechanical repair claims are unaffected and remain fully available.
Mechanical repair coverage has been one of the few lines on TruStage's servicing dashboard marked available since the dashboards went up on August 20. In the September 11 edit its section label and both of its function rows — manage policy or contract, and cancel policy or contract — changed from available to partially available. No other label on that dashboard moved.
TruStage did not explain the change, and it did not edit the sentence under the heading, which still says mechanical repair coverage servicing remains available through Assurant's normal servicing channels. The page therefore now contradicts itself on this product: the prose says available, the labels say partially available. A credit union should treat the label as the more current of the two, since the labels are what TruStage moved.
The downgrade is limited to servicing. On the claims dashboard, mechanical repair coverage claims remain fully available through Assurant's established claims process, with submission, processing and payout all still marked available and the section untouched in this edit. So a member with a repair claim in progress is in the same position as yesterday; a member trying to change or cancel a contract may not be.
TruStage now lists what its representatives can actually do: retirement balances, loans and distributions and investment changes for eligible plans, and annuity withdrawals, surrenders, direct deposit updates and application cancellations. Retirement digital access remains unavailable and employer contributions still run on interim processes.
The September 11 edit rewrote the policy and contract servicing and disbursements sections of the outage hub, the credit union page and both matching dashboards, replacing general descriptions with named capabilities. On retirement, representatives can now give account balance information, support loans and distributions for eligible plans, and take investment change requests for eligible plans. On annuities, available servicing now includes withdrawal processing, surrender processing, direct deposit servicing, application cancellations and annuity death claim support. Life and AD&D representatives are described as able to answer many policy inquiries, point customers to service forms and continuity processes, and explain servicing options and next steps.
Two limits are stated as plainly as the additions, and both matter to a credit union fielding calls. TruStage says retirement digital access remains unavailable while recovery continues — the first time it has said so in those terms on its own servicing dashboard, after CrossState described restoring digital access as a phased priority on September 9. And employer contribution processing continues to run through interim continuity solutions rather than normal systems. The broader caveat is repeated across all three surfaces: some servicing requests still require interim or manual processes, and certain functions remain limited.
The same rewrite dropped three reassurances from the hub and credit union summary blocks that had been there since September 4 — that outage-period requests would be honored based on their original submission date, that recurring ACH and certain recurring card payments had resumed for eligible life and AD&D customers, and that coverage protections and grace period accommodations remain in place. Two of the three survive in the FAQ accordions further down the credit union page, which still describe the recurring ACH and card restarts by date and still say TruStage is extending applicable grace periods. The submission-date commitment survives there in different words: the FAQ says requests received during the outage will be processed and honored based on the date they were received. Nothing was retracted; the summary block was shortened.
Disbursements moved in the same direction. The September 11 edit replaced the hub’s “some disbursement services are currently available” with “disbursement capabilities continue to expand across Life,” while the disbursements dashboard headline still read unavailable and still showed life one-time withdrawals and surrenders as unavailable. TruStage dropped the “across Life” qualifier on September 14 — see the later item; the divergence with the dashboard is unchanged. Read the per-product dashboard rather than the roll-up when a specific transaction is at stake.
TruStage's claims dashboard now reports more than $6.6 million in recent credit insurance and debt protection life payments, and says that accounts for all outstanding pre-outage debt protection life and credit life claims. It is the first completion of any kind TruStage has claimed. GAP is not included.
The payment protection section of TruStage's claims dashboard was rewritten in the September 11 edit. It now says additional claim payments have recently been delivered to members, including more than $6.6 million in credit insurance and debt protection life claim payments, and that this accounts for 100 percent of outstanding payments for debt protection life and credit life claims submitted before the outage.
Read the scope narrowly. The completion statement covers two coverages — debt protection life and credit life — and only claims submitted before the July 11 outage. The same section also covers GAP, and GAP is named nowhere in the completion sentence; the dashboard's earlier line saying review of GAP claims filed after July 11 had begun was removed in the same edit and replaced, on the hub, with a general statement about post-July 11 claims review continuing. Nothing here says GAP claims are finished.
This is the first time in the incident that TruStage has described any category of claims as fully paid rather than in progress, and the coverages involved are credit union lending products, so it is directly relevant to a credit union's own members. The availability labels did not move to match: submission, processing and payout for payment protection all remain partially available, which is consistent with post-outage claims still being worked.
TruStage removed the mid-September date for finishing most pre-July 11 life and AD&D claims, and removed the older “end of next week” wording from its claims dashboard. In their place it reports more than $44 million in pre-outage life and AD&D claims paid, and no completion date at all.
Between this tracker's 4:01 p.m. and 6:01 p.m. Eastern checks on September 11, TruStage rewrote the dated update blocks on its outage hub and its credit union outage page, rolling both from September 4 to September 11, and rewrote all three of its status dashboards. The single most consequential edit is a deletion. The sentence saying TruStage expected to complete payment of most life and AD&D claims submitted before July 11, 2026 by mid-September is gone from both pages, and nothing dated replaced it.
The claims dashboard lost its own timing at the same moment. Its life and AD&D sections had carried an undated expectation that most pre-outage claims would be paid “by the end of next week” since the afternoon of August 28, unchanged in body for two weeks after the week it pointed at had passed. Both sections now say instead that claims continue to be reviewed, processed and paid as capabilities are restored. That closes the divergence this tracker had been reporting since September 4, when the two surfaces published different expectations — but it closes it by withdrawing both, not by reconciling them.
What TruStage publishes in their place is a progress total rather than a schedule: more than $44 million in pre-outage life and AD&D claims have been paid, with teams continuing to work through the remainder, including claims that need additional documentation. The figure appears on the hub, the credit union page and both dashboard sections, and it is the first dollar figure TruStage has put on any of its own outage surfaces — until now the only public numbers came from CrossState on September 9 and Credit Union Daily on September 10, and neither used this scope. The hub also replaced its narrower line about GAP claims filed after July 11 with a general statement that review of claims submitted after July 11 continues as capacity expands.
For a credit union the practical effect is that there is now no published date for any claim. A member told in early September to expect payment by mid-September has been given an expectation TruStage no longer stands behind in public. No availability label moved with the change: claims submission, processing and payout remain partially available across every product line on the dashboard.
TruStage has reverted the contact-details answer it expanded on its annuity outage page this morning. The Annuity Transaction Capabilities and Annuity Disbursements pointers and the advisor line 877-345-4769 are gone; the answer now gives only 800-798-5500. The advisor number still appears on TruStage's policy and contract servicing dashboard.
At this tracker's 2:01 p.m. check on September 11, the answer to “How can I access my annuity contract details?” on trustage.com/outage/annuity closed by directing customers to the Annuity Transaction Capabilities resource and the Annuity Disbursements FAQs for availability by transaction type, and gave two numbers: clients 800-798-5500, advisors 877-345-4769 with Option 2 twice. At the 4:01 p.m. check that closing passage was gone. The answer now ends by saying customers may call 800-798-5500. Everything before it is unchanged, and the Mandiant answer rewritten in the same morning edit was left in place.
Where the withdrawn items stand now. The advisor line 877-345-4769 is back to appearing on one tracked TruStage surface only — the policy and contract servicing status dashboard, which has carried it since August 20 and which nothing on the site links. The 800-798-5500 number survives in three places: this answer, that same dashboard, and the variable universal life FAQ, where it is given as a general assistance and TTY number rather than an annuity line. Neither the Annuity Transaction Capabilities resource nor the Annuity Disbursements FAQs appears on any tracked TruStage page at this check. TruStage has not said whether they were renamed, withdrawn, or published ahead of schedule, and this tracker is not inferring which.
What a credit union should do with it. If anyone routed an annuity question this afternoon using the advisor line or those resource names off the outage page, re-check the page before repeating the referral. The annuity page's standing direction is unchanged and is the safe one: the Annuity Contact Center at 855.591.9027, Monday through Friday, 8:00 a.m. to 5:00 p.m. Central.
Two notes on method, because they affect anyone watching these pages directly. First, the page's “Last Updated” stamp did not move with this reversal — it still reads September 11, 12:20 p.m. Central, the value it took in the morning edit — so the stamp cannot be used to tell whether a TruStage outage page has changed. Second, this tracker's standing-claim check caught the withdrawal on the same run and the earlier entry was corrected rather than left standing; the record of what the page said at 2:01 p.m. is kept in that entry.
Superseded. On September 11 TruStage's wealth management solutions outage page took the affirmative Mandiant wording the annuity page had taken hours earlier. TruStage withdrew it on the evening of September 14; the page now states only that no threat-actor evidence was found.
Between this tracker's 2:01 p.m. and 4:01 p.m. checks on September 11, TruStage rewrote the containment answer on trustage.com/outage/business/wealth-management-solutions. The question is unchanged and still asks whether a cybersecurity expert has provided information on whether the incident is contained and whether TruStage is operating in a clean and safe environment. The answer had carried the September 3 wording, which reported only what Mandiant did not find. It now leads with the affirmative finding — that on the forensic evidence reviewed to date, Mandiant reported TruStage's operating environment is clean, the incident is contained and it identified no indication of active intrusion — keeps the no-activity sentence below it, and closes by pointing to the August 27 Investigation Memo.
This is the same rewrite the annuity page took about four hours earlier, and it makes the rollout a genuine propagation rather than a one-page experiment. Who is speaking still matters: like the annuity page, this one attributes the conclusion to Mandiant and does not answer yes or no in TruStage's own voice. The Canadian affiliate's FAQ at trustage.ca, which has carried a version of the sentence since August 24, does open with an affirmative yes and states the conclusion in TruStage's voice. A credit union quoting a US page is quoting a report of what TruStage's forensic firm concluded, within a scope Mandiant has not publicly defined.
Three outage pages still carried the September 3 wording at this check — business, credit union and preplanning. The retirement page still carried the oldest version, which opened with an affirmative yes, cited an undated memo and had taken neither rewrite. The individual outage page carries no Mandiant answer at all. Until the rollout finishes, two credit unions reading two TruStage pages will still get materially different answers to the same question.
One verification note for anyone watching these pages directly: this edit did not move the page's “Last Updated” stamp, which still reads September 11, 12:20 p.m. Central — the same value it carried at the 2:01 p.m. check, before the body changed. The stamp is not a reliable signal that a TruStage outage page has been edited. Nothing here changes service status or what to tell a member.
Correction, September 14: TruStage has withdrawn this wording. Between this tracker's 4:01 p.m. and 7:50 p.m. checks on September 14 the wealth management solutions page's answer was rewritten again, and the affirmative clean-and-contained sentence described above no longer appears on it. This page was the last US outage page carrying that sentence, so with this edit the affirmative finding is off every US TruStage outage page. This entry is kept as the record of what the page said between September 11 and September 14; for the current wording and what changed, see the September 14 entry.
The same edit adds a recovery sentence found on no other tracked TruStage page: more customers and members are reaching TruStage, more claims are moving through the process and more transactions are being completed — while some services still rely on interim or manual processes. No figures are attached.
The September 11 afternoon edit to trustage.com/outage/business/wealth-management-solutions also extended the answer to “When will this be resolved?” The existing paragraph — phased recovery, a broad portion of the technology environment affected, systems restored carefully, some capabilities needing more time — is unchanged. Appended to it is a new characterization of where recovery stands: that it is increasingly moving “from access to execution,” with more customers and members reaching TruStage, more claims moving through the process and more transactions being completed, and that some services continue to rely on interim or manual processes.
The framing is new to this record. TruStage's recovery language to date has described what has been restored and what has not; this sentence describes a shift in the character of the problem — from whether a customer can get through at all to whether the work behind the call can be finished. The caveat travels in the same sentence, and it is the operative half for a credit union: interim and manual processes are still in use, which is what turnaround times and error rates depend on.
What the sentence does not carry is any number, date or product scope. It names no volumes, no completion target and no service that has moved from one state to the other, so it cannot be used to tell a member that a specific capability is now working. For that, TruStage's service status dashboards remain the concrete reference. The mid-September target for most Life and AD&D claims submitted before July 11, which this item originally named alongside them, was deleted by TruStage later the same day.
At this check the sentence appeared on the wealth management solutions page only; the same answer on the business, credit union, annuity, preplanning and retirement pages still ends at the older wording. As with the Mandiant rewrite carried in the same edit, the page's “Last Updated” stamp did not move.
Update, September 14: the sentence is no longer confined to one page. On the evening of September 14 TruStage appended it, word for word, to the same answer on the general business outage page, which is the first time this characterization has propagated. See the September 14 entry for that edit.
Update, September 15: the credit union and individual pages took the sentence too, putting it on four pages. The annuity, preplanning and retirement answers still end at the older wording. See the September 15 entry.
Superseded the same day. For roughly four hours on September 11 TruStage's annuity outage page pointed customers to its Annuity Transaction Capabilities resource and Annuity Disbursements FAQs and printed a client line of 800-798-5500 alongside an advisor line of 877-345-4769. By this tracker's 4:01 p.m. check the answer gave only 800-798-5500.
The September 11 edit that rewrote the Mandiant answer also extended the answer about accessing annuity contract details on trustage.com/outage/annuity. Where the answer had ended by saying online access may stay limited during a controlled recovery, it added a pointer to the Annuity Transaction Capabilities resource and the Annuity Disbursements FAQs for current availability by transaction type, and gave two numbers: clients could call 800-798-5500, and advisors could call 877-345-4769 and select Option 2 twice. This tracker recorded that at its 2:01 p.m. check.
By the 4:01 p.m. check TruStage had reverted the addition. The answer's closing sentence now reads only that customers may call 800-798-5500; the two resource pointers and the advisor line are gone, and the “clients” and “advisors” framing with them. The page's Mandiant answer, rewritten in the same edit, was left in place. The reversal is recorded as its own entry, 2026-09-11-trustage-annuity-contact-answer-pullback.
What a credit union should use today: the annuity outage page still directs customers to the Annuity Contact Center at 855.591.9027, Monday through Friday, 8:00 a.m. to 5:00 p.m. Central, and that line has not moved. The 800-798-5500 number remains inside this FAQ answer and also appears on TruStage's policy and contract servicing status dashboard and in the variable universal life FAQ. The advisor line 877-345-4769 is back to appearing only on that servicing dashboard, which nothing on the site links. Neither number was ever new to TruStage's site; both have been on the dashboard since August 20.
The same edit also relabelled one form on the page, from an application cancellation form to an annuity application cancellation form, and that relabel survived the reversal. This tracker corrected this entry in the run that found the reversal rather than leaving the earlier wording standing.
Superseded. On September 11 TruStage's annuity outage page replaced its narrow Mandiant answer with an affirmative one — environment clean, incident contained, no indication of active intrusion. TruStage withdrew that wording on September 14; the page now states only that no threat-actor evidence was found.
Between this tracker's 12:01 p.m. and 2:01 p.m. checks on September 11, TruStage rewrote the containment answer on trustage.com/outage/annuity for the second time in nine days. The question is unchanged and still asks whether a cybersecurity expert has provided information on whether the incident is contained and whether TruStage is operating in a clean and safe environment. Since September 2 the answer had reported only what Mandiant did not find — no threat-actor activity within the scope of its investigation since July 11. The answer now leads with an affirmative finding attributed to Mandiant: that on the forensic evidence reviewed to date, TruStage's “operating environment is clean, the incident is contained” and Mandiant has identified no indication of active intrusion. The earlier no-activity sentence is kept below it, and the closing pointer now reads as the August 27 Investigation Memo rather than Mandiant's most recent memo.
This reverses the direction of the September 2 change on the same page. That edit made the annuity page the first US surface to drop an affirmative answer; this one makes it the first US surface to carry the fullest affirmative wording TruStage has published anywhere. Note who is speaking. The Canadian affiliate's FAQ at trustage.ca has carried a version of this sentence since August 24, but there it opens with an affirmative yes and TruStage states the clean-and-contained conclusion in its own voice. The US annuity page attributes the conclusion to Mandiant and does not answer yes or no in TruStage's voice. The distinction matters for anyone quoting the page: this is a report of what TruStage's forensic firm concluded, within a scope Mandiant has not publicly defined, not a company guarantee.
The rollout is partial, as every TruStage wording change in this record has been. At the 2:01 p.m. check four other outage pages — business, credit union, wealth management solutions and preplanning — still carried the September 3 wording with the August 27 memo reference; by the 4:01 p.m. check the wealth management solutions page had taken the new wording, leaving three. The retirement page still carried the oldest version, which opened with an affirmative yes, cited an undated memo, and had never taken either rewrite. The individual outage page carries no Mandiant answer at all. Expect the new wording to spread over the coming days; until it does, two credit unions reading two TruStage pages will get materially different answers to the same question.
The whole outage family re-stamped in this edit, moving to September 11, 12:20 p.m. Central, but only the annuity page's body changed. For a credit union nothing here changes service status or what to tell a member. It matters because this is the answer a member, a board or an examiner is most likely to be pointed at when they ask whether the incident is over, and because it is the first time a US TruStage page has said so affirmatively.
Correction, September 14: TruStage has withdrawn this wording. Between the 2:01 p.m. and 4:01 p.m. checks on September 14 the annuity page's answer was rewritten a third time, and the affirmative clean-and-contained sentence described above no longer appears on it. The page now reports only that Mandiant found no evidence of threat-actor activity in the affected environments since July 11. This entry is kept as the record of what the page said between September 11 and September 14; for the current wording and what changed, see the September 14 entry.
TruStage now says customers may mail a premium payment during the outage and has published four product-specific addresses at trustage.com/outage/individual/payments. Online one-time payments remain unavailable, and TruStage says it still cannot mail a bill or confirm a total past-due balance.
TruStage rewrote the payment answer in the FAQ on trustage.com/outage/individual in the same September 10, 3:38 p.m. Central edit that added Saturday phone hours. The previous answer said only that payment processing was limited and that customers could pay once operations were restored. The new answer says online one-time payments are unavailable, that TruStage is unable to mail a bill or provide a total past-due balance, that customers will not lose coverage because they could not pay during the disruption, and — this is the new capability — that a payment may be submitted by mail with the policy or certificate number written on the check or money order.
The addresses live on a new sub-page, trustage.com/outage/individual/payments, stamped September 10 and linked only from that rewritten answer. It gives four lockboxes, all in the name of CMFG Life Insurance Company: PO Box 4651, Carol Stream, IL 60197-4651 for accidental death and dismemberment; PO Box 4652, Carol Stream, IL 60197-4652 for AD&D coverage written through New Jersey credit unions; PO Box 4650, Carol Stream, IL 60197-4650 for life and health; and 2000 Heritage Way, Waverly, IA 50677 for annuity and variable universal life. The page also shows sample policy-number formats so a customer can find the right number, and links a “Locate your number” helper. This tracker has added the page to the set it sweeps every cycle.
Two things to keep straight when you brief staff. The phone number printed on the new page, 1-833-374-1541, is TruStage's general sales line for licensed agents, not an outage contact — the outage line for individual policyholders was 855-591-9026 at the time of this entry, and is 1-800-779-5433 since TruStage swapped it on September 15. And the mail channel is a workaround, not restored billing: TruStage still cannot tell a member what they owe, so a member who mails a payment is estimating. The grace-period protection is the safety net TruStage points to, and it continues to say more than one premium may come due once the extended grace period ends.
The rewritten answer appears on the individual outage page only. As of this check no other tracked TruStage surface carries the mail-payment wording or links the new addresses page, so treat it as the start of a rollout rather than a company-wide change, and expect the wording to appear on other product pages over the coming days.
TruStage's individual outage line, 855-591-9026, now publishes Saturday hours of 9:00 a.m. to 1:00 p.m. Central alongside its weekday 8:00 a.m. to 5:00 p.m. Central. It is the first TruStage-owned page to carry the narrowed Saturday window that CrossState and CU Daily reported earlier this week.
Between this tracker's 4:01 p.m. and 6:01 p.m. Eastern checks on September 10, TruStage rewrote the “We're here for you” paragraph on trustage.com/outage/individual and re-stamped the page September 10, 3:38 p.m. Central. The contact sentence, which since September 2 had read weekdays only, now adds Saturday, 9:00 a.m. to 1:00 p.m. Central. The number itself did not move: it is still 855-591-9026, and the rest of the paragraph — that representatives have very limited access to account information and cannot process transactions or submit requests, and that call times may be longer than usual — is unchanged.
This closes a gap this tracker flagged twice. TruStage removed Saturday hours of 9:00 a.m. to 4:00 p.m. Central from this page on September 2 when it swapped 844-958-8910 for 855-591-9026. CrossState published a narrowed Saturday window of 9:00 a.m. to 1:00 p.m. Central on September 9 and CU Daily carried the same window on September 10, but neither could be corroborated against a TruStage surface, so our member page deliberately published no Saturday hours at all. TruStage's own page now states the narrowed window, and our guidance is updated to match.
Two cautions for credit unions. The Saturday hours are published on the individual outage page only — the annuity, retirement, preneed, business, wealth-management and credit-union outage pages carry no Saturday hours, and the annuity contact center at 855-591-9027 is still listed weekdays only. And TruStage announced none of this: no newsroom release accompanied the edit, and the page's stamp is the only public marker that it changed.
TruStage's credit-union outage page now answers directly whether it will contact members: if it determines member, employee, or other data was affected, credit unions hear it from TruStage first, with time to plan their own communication. The answer also names data-analysis firm Epiq Global.
Between this tracker's 2:01 p.m. and 4:00 p.m. checks on September 9, TruStage added a new question to the credit-union section of its outage site — “Will TruStage be notifying our members about the incident directly?” — and moved the shared outage-family stamp to September 9, 1:03 p.m. CT. The answer says the investigation is still running, supported by Mandiant and Epiq Global, and that if TruStage determines member, employee, or other affected data has been impacted, credit unions will hear that information from TruStage first, with the stated intent of giving them time to partner on any communication that follows. TruStage repeats that it will support credit unions through notification and reporting requirements.
The notification commitment itself is not new — TruStage has said since July that it would work through credit unions before contacting their members, and this tracker has carried that as a confirmed fact. What is new is where it now sits: a plainly worded question on the credit-union page, rather than a clause inside a longer investigation answer. Epiq Global is the more substantive addition. TruStage named the firm in its August 12 partner update, and trade press and a peer association reported it the same week, but no TruStage-owned public page had carried the name until today. This is the first, and it puts the two-vendor structure of the data review — Mandiant on the forensics, Epiq on the data analysis — on an official surface credit unions can cite.
Read the answer for what it does not say. It states no date, gives no notification timetable, and does not say that any data was affected; TruStage's position that it does not yet know remains unchanged across every page checked. One other edit landed in the same pass: the GAP and MRC question was retitled from whether waivers and certificates “issued during the outage” will be honored to whether those “sold during the outage” will be, and its answer picked up the sentence about TruStage developing processes to capture workaround data and issue member contracts. That sentence has been elsewhere on the same page since late August, so this is consolidation rather than new guidance. The other five dated outage pages took only the stamp line.
TruStage retitled its annuity outage page “Annuity forms and resources” and relabelled its withdrawal, surrender, partial withdrawal and allocation forms “Annuity and VUL,” pointing variable universal life owners there. Its separate VUL product FAQ still tells those owners partial withdrawals cannot be made online.
Between this tracker's 2:01 p.m. and 4:00 p.m. checks on September 8, TruStage rewrote the headings on its annuity outage page so that variable universal life is named throughout. The page title went from “Annuity” to “Annuity forms and resources,” and the section and form headings were rescoped: owner resources, withdrawal and surrender requests, general resources, allocation change and transfer forms, and the downloadable partial withdrawal and surrender forms are now all labelled “Annuity and VUL.” Variable universal life is named eight times on the page; before this edit it appeared once, on the VULI and VULII allocation change form TruStage added there on September 2.
No form was added or removed and no wording below the headings changed. The AssureSign electronic partial withdrawal and surrender forms, the mailed PDF versions, the death benefit and RMD forms, and the annuity contact center details — 855.591.9027, Monday through Friday, 8:00 a.m. to 5:00 p.m. CT — are all as they were. TruStage's “Last Updated” stamp did not move; it still reads September 8, 7:38 a.m. CT, so the company's own published date does not reflect this edit, the same undated pattern recorded when the direct deposit form was added on August 19 and the VUL allocation form on September 2.
Worth knowing if you field member calls: TruStage's own variable universal life product FAQ, at trustage.com/my-account/help/variable-universal-life-faqs, has not been changed to match. It tells VUL owners that partial withdrawals cannot be made online at this time and to call customer care, and that allocation changes and fund transfers must be made by printing and mailing a Service Request form or by phone. The outage page now offers those same owners an electronic partial withdrawal form through AssureSign. The two pages also carry different contact details: the FAQ's contact block gives 1-855-591-9026, weekdays 7:00 a.m. to 6:00 p.m. CT, and directs document requests to 1-800-798-5500, while the annuity outage page gives 855.591.9027 and shorter hours.
TruStage has not said which route it wants VUL owners to use, and this tracker is not in a position to say either — both pages are TruStage's own. Members asking about a VUL withdrawal or allocation change are best pointed at the annuity outage page, which is the surface TruStage keeps current during the outage, with the caveat that the product FAQ still says something different. As with the other forms published during the outage, these are workarounds rather than restored processing; the page still tells customers they may have difficulty accessing account information, completing transactions or submitting requests online.
TruStage now names a temporary process letting participants in most defined contribution plans change investment elections, transfer and rebalance — its first such route since the outage. Plans using its Choice Group Variable Annuity are excluded, and their payroll files still cannot be processed.
Between this tracker’s 2:01 p.m. and 4:00 p.m. checks on September 4, TruStage substantially rewrote its retirement outage page and moved the shared outage-family stamp to September 4, 2:09 p.m. CT. The page now describes a temporary process that lets participants change investment elections, request transfers, and rebalance their investments. TruStage limits it to defined contribution plans — 401(k) and 403(b) — together with governmental and tax-exempt 457(b) plans recordkept on Matrix, meaning plans that do not use its Choice Group Variable Annuity, and says the capability reaches most but not all of those. Participants are told to confirm eligibility with the Participant Service Center at participantservicecenter@benefitsforyou.com, then to request a plan-specific form carrying fund fact sheets and prospectuses from a TruStage Education Services Center at educationsolutions@trustage.com. Existing elections stand unless a participant submits a request.
This is the first route back to investment transactions TruStage has publicly described for retirement participants. Until today the page said only that interim processes let some participants call for balances and forms; the answer that had listed investment election changes and trade requests among the unavailable functions was removed on August 18 without TruStage saying those functions had returned. Read the limit as carefully as the capability. Participants in Choice Group Variable Annuity plans get nothing here, and TruStage says separately that it still cannot accept payroll files for those plans at all, though it will hold their deposits in a non-interest-bearing account until the money can be allocated to participant accounts.
The plan sponsor section was rebuilt around plan type. For Matrix-recordkept plans, files arriving through an automated payroll-provider or aggregator integration keep processing, and TruStage says its payroll team will make contact when a file arrives not in good order or needs funding approval. Employers who normally upload files themselves, or whose providers use MoveIt or another non-automated route, were emailed an interim process on August 19 for uploading through a TruStage secure portal. Sponsors are told to keep using their pre-outage templates for payroll funding and loan payoff files, to keep enrolling newly eligible employees under the terms of the plan document, and — for every plan type — that contributions are being processed as of the payroll check date, so pricing matches the date the money should have gone into the market. TruStage also links, for the first time on its own site, a white paper from its outside counsel Groom Law on the Department of Labor guidance behind its position that employers have additional time to submit payroll files when a service-provider outage causes the delay. That link, trustage.com/ProcessingDelayWhitePaper (PDF, downloads to your device), downloads a PDF rather than opening a page. A peer association reported the paper existed on August 8; TruStage had not published it publicly until now.
Two smaller edits are worth flagging. The statement answer now says quarterly participant statements are mailing on the normal schedule for most plans, and that statements for Choice Group Variable Annuity plans may be delayed — a qualification the earlier wording did not carry, and which replaced the week of August 10 mailing date previously given for participants who had elected electronic delivery. Separately, the answer on whether accounts were affected was cut to a single sentence saying participant assets remain safe and invested; the withdrawal, loan and balance-by-phone detail it used to carry still appears elsewhere on the same page, so that is a consolidation and not a withdrawal of the capability. None of this reached any other TruStage surface at this check — the other five dated outage pages took only the stamp line — and the retirement page remains the only outage page still carrying the older Mandiant answer and the August 10 memo link, which survived today’s rewrite untouched.
Superseded. TruStage said on September 4 that it expected to finish paying most life and AD&D claims filed before July 11 by mid-September — later than the week its August 28 dashboard wording pointed at. It deleted the sentence on September 11 and published no date in its place.
Withdrawn September 11. TruStage removed this expectation from both pages that carried it in its September 11 rewrite, and set no new date; see the September 11 item on the withdrawal. What follows is the record of what those pages said for the week it stood.
At this tracker's 6:01 p.m. check on September 4, the outage hub at trustage.com/outage and the credit union outage page had both gained dated “Latest update — Sept. 4” blocks under all three service categories: claims, policy and contract servicing, and disbursements. Neither page has carried per-category dated updates before, and no other tracked TruStage surface carries this text.
The headline is the timing. TruStage says it expects to complete payment of most life and AD&D claims submitted before July 11, 2026, “by mid-September.” That is the first time it has restated the claims-payment expectation since its claims dashboard published one on the afternoon of August 28, and it moves the target: read on August 28, the dashboard's undated “end of next week” pointed at the week beginning August 31, which ends today. Credit unions that told members to expect payment this week should expect it to run about another week and a half.
The dashboard itself was not changed. At the same check the claims dashboard still read “by the end of next week,” unchanged in body for the sixty-fifth consecutive snapshot since August 28 — so TruStage is now publishing two different expectations in two places, and the dashboard's carries no date stamp to date it by. Read the hub or the credit union page for the current one.
The other blocks restate and narrow ground already covered. On servicing, TruStage says representatives can answer basic policy questions, explain servicing options, guide callers on forms and continuity processes, and escalate concerns; that requests submitted during the outage will still be honored based on their original submission date, which it had not said before; that recurring ACH and certain recurring credit card payments have resumed for eligible life and AD&D customers using payment details already on file; and that coverage protections and grace period accommodations remain in place. On disbursements it says some services are now available and points life, annuity, retirement and executive benefits account holders to its disbursements page — while the disbursements dashboard's own headline still reads unavailable. No availability label moved with any of this: all nine functions across the three categories remain marked partially available.
TruStage now points credit unions to a newer Mandiant investigation memo, which it dates August 27, replacing the August 10 one on four of its six outage pages. The credit-union and retirement pages still showed the older answer and memo this afternoon.
Between this tracker’s 12:02 p.m. and 2:01 p.m. checks on September 3, TruStage replaced the cybersecurity-expert FAQ answer on three more outage pages — business, wealth management solutions, and preplanning — with the wording its annuity page took on September 2. The question is unchanged and still asks whether an expert has provided information on whether the incident is contained and whether TruStage is operating in a clean and safe environment as systems return to service. All four pages now answer that Mandiant has not identified any threat actor activity within the environments in the scope of its investigation since July 11, 2026, which TruStage describes as the date it first became aware of the incident and took measures to contain and remediate it. Unlike the September 2 edit, TruStage moved its “Last Updated” stamp with this one: the six dated outage pages now read September 3, 11:26 a.m. CT.
The second change is the document itself. All four rewritten pages now describe the linked file as Mandiant’s most recent investigation memo dated August 27 — a newer memo than the August 10 one TruStage published on its own site and this tracker has linked since August 11. The link target moved with the wording: the business and annuity pages point to trustage.com/mandiant-investigation-memo, an undated address that resolves to a different stored file than the dated August 10 address, which is still live. The two pages that kept the earlier answer — credit union and retirement — still link the August 10 memo, so at this check TruStage was publishing both memos at once, with which one a reader gets depending on the page they start from.
Read this narrowly. The August 27 date is TruStage’s description of the document; this tracker links what TruStage links but did not read the memo itself, and Mandiant confines its findings to the environments within its investigation’s scope, which it has not publicly defined. Nothing here is a finding about whether data was accessed, which TruStage still says requires extensive investigation. No availability label moved with the change and every outage page still shows status Investigating, so it is not a restoration announcement. The practical effect for a credit union is narrower and concrete: the memo you may have filed on August 11 is no longer the one TruStage points to.
One mechanic is worth noting for vendor-management files. The earlier memo had a dated short URL and a dated filename; the replacement has neither, so a future revision could appear at the same address without the link changing. The date TruStage prints in the outage-page sentence is the only version marker it publishes, which is what this tracker now watches. The Resources list on this page has been repointed to the newer memo.
TruStage now says most individual policy-service transactions — address changes, beneficiary changes, and cancellations — still have to be submitted by mail, and that email, fax, and online upload have been reviewed but not approved. Claims can still be started online.
At this tracker’s 4:02 p.m. check on September 3, TruStage’s outage page for individuals had gained three new questions under a new policy-servicing topic. TruStage says a policyholder who needs a change such as an address or beneficiary update, or who wants to cancel, should follow the instructions on the applicable form on its individual service-forms page, and that for many customer-service transactions the form has to be submitted by mail. It gives its reason: mail keeps forms and supporting documentation inside a controlled process carrying the customer authorization it needs, and helps it meet security, privacy, and record-retention requirements while recovery continues. First notice of loss can still be filed online at trustage.com/startclaim, which TruStage says routes to its claims team.
The second new answer is the one worth passing to members. TruStage says it has reviewed alternative channels including email, fax, and online upload, but that sensitive payment information and other restricted consumer information mean the appropriate security, privacy, authentication, and retention controls have to be in place and approved before any of them can be used. It says teams continue to evaluate whether more channels can be opened, and names no date. For certain products it says limited phone-based transaction support may be available and tells customers to ask the service team for their product what it can currently do.
Practical effect for a credit union fielding member questions: mail remains the route for individual life and AD&D policy servicing, and TruStage has not announced a digital alternative. This does not change annuity servicing, where TruStage has separately accepted e-signed forms, or claims intake, which stays online.
TruStage did not move this page’s “Last Updated” stamp with the edit — it still read September 3, 11:26 a.m. CT, the time of a separate change made that morning. The three answers were on the individual page only; no other tracked TruStage surface carried them at this check, and none had carried them in any earlier snapshot. The page also took the topic-browse FAQ layout the credit-union outage page was already using, and TruStage fixed two typographical errors in its billing answers at the same time.
On September 3 TruStage's credit union outage page took Mandiant's August 27 memo answer and the answers saying most policy-service forms must be mailed. TruStage also removed the July CEO video from that page. Only the retirement page then kept the older Mandiant answer.
Between this tracker's 4:02 p.m. and 6:42 p.m. checks on September 3, TruStage made three changes at once to trustage.com/outage/business/credit-union — the page it directs credit unions and their staff to.
First, the page took the rewritten containment answer this tracker recorded at 2:01 p.m. on the business, wealth management solutions, and preplanning pages. It now says Mandiant has not identified any threat actor activity within the environments in the scope of its investigation since July 11, 2026, and points to Mandiant's most recent investigation memo dated August 27. The link moved with the wording, from the dated August 10 address to the undated one. That brings the rewrite to five of the six US outage pages; the retirement page alone still carries the earlier answer and still links the August 10 memo, which remains live at its own address. Both memos are therefore still published, and which one a credit union reaches now depends on whether it starts from the retirement page.
Second, the three policy-servicing answers TruStage added to its individual outage page two hours earlier appeared here as well: that many customer-service transactions require the form to be mailed, why mail is required, and that email, fax, and online upload have been reviewed but not approved pending security, privacy, authentication, and retention controls. No date is given for any of them. This is the first time that guidance has reached a credit-union-facing surface, and it is the answer to give a member asking how to change a beneficiary or cancel a policy today.
Third, TruStage removed the CEO video and its transcript from the page. The transcript had been present in every snapshot of this page since July 29 — 233 consecutive checks — and is now absent both from the extracted text and from the page's own markup, which no longer carries a video embed. That video was the last place on any live TruStage page where the withdrawn mid-August recovery target still appeared; it now survives only in the July 31 and August 13 newsroom releases, which remain posted as dated records. TruStage did not announce the removal, did not move the page's "Last Updated" stamp with the edit, and published nothing in the video's place. It also corrected the wording of its August 20 credit-card-draft sentence at the same time, without changing what it says.
Update, October 27: the retirement page replaced that answer with Mandiant's October 9 wording, so every outage page carrying the question now gives the same answer.
CMFG Life told variable universal life policy owners on September 2 that eight transaction types now run on interim processes, among them premium payments, withdrawals, surrenders, death benefit claims and Section 1035 exchanges. Policy loans and dollar cost averaging are still not supported, and policies will not lapse for missed premiums during the disruption.
TruStage's life insurance side reached the SEC record on September 2 for the first time in this tracker. Every earlier filing logged here came from an annuity registrant; this supplement was filed by the CMFG Variable Life Insurance Account (CIK 0000732726), a fourth TruStage registrant, and covers three life products — MEMBERS Variable Universal Life I, MEMBERS Variable Universal Life II and Ultra Vers-All Life. It was filed twice the same day, once by the account and once by its filing agent; the two documents carry the same text.
The supplement names eight transaction types that interim processes now support for these policies: payment of additional planned premium, payment of subsequent premium, partial withdrawals, surrenders, transfers among allocation options, changes to allocation instructions, death benefit claims, and Section 1035 exchanges into a policy at another insurer. It says TruStage is still building interim processes for other financial transactions and gives two examples that therefore are not available — loan processing and dollar cost averaging. Financial requests such as withdrawals and surrenders are being worked first; non-financial requests such as a change of owner or an assignment are described as processed when administratively possible.
Two protections matter to any credit union fielding a call about a lapsed policy. TruStage says the event has not affected policy values or benefits, and that a policy will not lapse or enter a grace period because a premium could not be paid during the disruption; policies already active or already in a grace period stay in that status until normal premium processing resumes, with extended grace periods as processing comes back. If a policy is in a grace period now, TruStage says it will write to the owner with the premium amount and the date it must be paid to avoid lapsing.
For contact, the supplement gives 800.798.5500 and states hours of 8:00 a.m. to 5:00 p.m. CST, adding that the hours may change as restoration progresses. That is the same number TruStage's policy servicing dashboard publishes as its annuity contact center, so the line is now documented as serving variable universal life owners too; no tracked TruStage outage page states hours for it, which makes this filing the only source here for them. The supplement also sends VUL owners to trustage.com/outage/annuity for forms rather than to the life service-forms page — which explains the VUL allocation form that appeared on the annuity page the same day — and repeats that paper forms may be mailed to Waverly, Iowa, and that requests are date- and time-stamped on receipt.
Two limits on what this filing shows. It is not a data finding: TruStage says it is still investigating the scope and impact of the event and makes no statement about whether information was accessed. And it is not this registrant's first outage disclosure — the same account filed a July 21 supplement for MEMBERS Variable Universal Life I that this tracker had not recorded, describing a far longer list of suspended transactions and interim processes limited to mailed withdrawal and surrender requests. That July filing dates the proactive shutdown to July 10, matching the annuity supplement already cited on this page and not the July 11 identification date on TruStage's outage pages; the difference remains unresolved by anything published.
Trade press: a second outlet confirms the Claims Contact Center reopening on 800-356-2644 and reports that TruStage has resumed recurring ACH and some recurring credit card payments for eligible life and AD&D customers. One-time telephone payments are still unavailable.
Credit Union Daily published its account of the same TruStage update to credit union partners on September 2 at 5:09 a.m., under Frank Diekmann's byline. It corroborates what CU Today reported the previous day: the Claims Contact Center is open again on 800-356-2644, weekdays 8 a.m. to 5 p.m. Central, covering life, accidental death and dismemberment, lending and business protection products plus certain annuity first-notice-of-loss support. That corroboration matters because the reopening still appears on none of the twenty-five TruStage surfaces this tracker sweeps.
The report adds material neither earlier record carried. TruStage has resumed recurring automated clearing house payments and certain recurring credit card payments for eligible life and AD&D customers, using payment details already on file. One-time payments by telephone remain unavailable, and some customers who normally get paper billing statements may not receive new ones yet. Servicing representatives can now answer basic policy questions, point members to service forms, explain servicing options and escalate complaints, but may still be unable to confirm the status of an individual transaction or request. TruStage also says requests submitted during the outage will be honored based on the date they were originally received.
One detail should be read with care. Credit Union Daily attributes the guidance to an "Aug. 1 update" to credit union partners, while CU Today dated the same communication September 1. Our record does not resolve which is right, and the question is not academic: the recurring statement that most pre-outage life and AD&D claims are expected to be paid by the end of next week means a different week depending on when it was issued. TruStage's own claims dashboard has carried that sentence unchanged since August 28, and it was byte for byte identical again in this evening's sweep, so this tracker keeps its existing note anchored to August 28.
The rest of the report restates limitations already published on TruStage's pages: no timeline for an individual claim, manual or offline handling for policy, beneficiary and ownership changes, cancellations and some disbursements, and longer processing times. It carries one direct acknowledgment from the company, that recovery has not been "a seamless experience" for credit unions, their employees or their members.
TruStage changed the phone number on its individual outage page from 844-958-8910 to 855-591-9026 and removed the Saturday 9 a.m.–4 p.m. CT hours, leaving weekdays 8 a.m.–5 p.m. CT. Credit unions that published the old number should correct it.
Between our 8:01 a.m. and 10:01 a.m. Eastern sweeps, TruStage rewrote the “We’re here for you” paragraph on trustage.com/outage/individual and re-stamped the page September 2, 7:26 a.m. CT. The number members are told to call is now 855-591-9026, replacing 844-958-8910. The change is not cosmetic: 844-958-8910 no longer appears anywhere in the page’s HTML, the visible body copy carries the new number, and its dial link matches it (tel:18555919026, plus four tel:1-855-591-9026 links in the page’s call widget). Published hours narrowed at the same time, from weekdays 8:00 a.m.–5:00 p.m. CT plus Saturday 9:00 a.m.–4:00 p.m. CT to weekdays only, now labelled “our current hours.”
The rewritten paragraph also softens what TruStage tells individual policyholders. It now says some call centers have opened with limited hours, and downgrades the long-standing line that representatives “cannot access” policy or account information to “very limited access”; they still cannot process transactions or submit requests. The sentence is new wording — it appears in none of the 4,472 snapshots this tracker has taken since July 20 — and it is the first general statement on an outage page that call centers have opened, as opposed to the product-specific notices already standing (the annuity outage page has said its contact center is open since August 18, and the August 13 release said the retirement call center was open). It does not name the Claims Contact Center or the 800-356-2644 number that CU Today reported on September 1 and CrossState relayed on September 2, so that specific reopening is still uncorroborated on TruStage’s own site.
Two cautions for credit unions. First, the new number is one digit from the annuity contact center’s: 855-591-9026 is the individual line, 855-591-9027 the annuity line, which is unchanged on the annuity outage page. Second, the swap is partial and unannounced — TruStage published no release, the other outage pages took only their routine stamp roll, 844-958-8910 still sits in the call widget on the retirement outage page, and CrossState was still telling members to call it at our 10 a.m. check. We cannot test whether the old number still answers and TruStage has not said; treat 855-591-9026 as the number TruStage now publishes for individual policyholders, not as proof the old one is dead.
One ambiguity is unresolved and predates the change. The same page prints 855-591-9026 twice more in a sales block advertising licensed agents at weekdays 7 a.m.–9 p.m. CT and Saturday 8 a.m.–4 p.m. CT — a second, wider set of hours on the same number. The number itself is not new to TruStage: it has been on the individual service-forms page since August 28 and is the number in the site-wide contact block. Verified against the live page rather than a search summary; one search summary this slot asserted a third hours set for it, weekdays 7 a.m. to 6 p.m. CT, which we could not find on the page and did not record.
TruStage added a downloadable allocation change form for VULI and VULII policies to its annuity outage page this afternoon. It is filed with the annuity allocation and transfer forms, not on the individual life and AD&D service-forms page.
Between this tracker's 2:42 p.m. and 4:01 p.m. checks on September 2, TruStage added a single line to the general resources block of its annuity outage page: a downloadable allocation change form for VULI and VULII policies. It joins the allocation and transfer forms already offered there for ZoneChoice, Zone Income Annuity, Zone Annuity, Horizon and Horizon II Variable Annuity, and Variable Annuity contracts. The page labels it as a PDF and opens it in a new window. This is the first VULI or VULII form to appear on any TruStage page this tracker monitors.
Nothing else on the page changed. The “Last Updated” stamp still reads September 2, 7:26 a.m. CT, so TruStage's own published date does not reflect the edit — the same pattern recorded when the direct deposit form was added on August 19. The annuity contact center details are unchanged: 855.591.9027, Monday through Friday, 8:00 a.m. to 5:00 p.m. CT.
Worth knowing if you field member calls: the form is on the annuity outage page, not on the individual life and AD&D service-forms page, where TruStage otherwise files life policy service forms by policy-number prefix. Anyone searching that page for it will not find it.
As with the other forms published during the outage, this is a workaround rather than restored processing. The annuity page still tells customers they may have difficulty accessing account information, completing transactions or submitting requests online, and TruStage has not said requests submitted on these forms will be handled any faster than its recovery timetable allows.
TruStage rewrote the containment answer on its annuity outage page. It no longer answers “yes”; it now reports that Mandiant has seen no threat-actor activity within its investigation’s scope since July 11. Five other US outage pages carried the earlier answer at that check; three took the rewrite on September 3.
Between this tracker’s 4:01 p.m. and 6:01 p.m. checks on September 2, TruStage replaced the answer to one FAQ on its annuity outage page. The question is unchanged and still asks whether a cybersecurity expert has provided information on (1) whether the incident is contained and (2) whether TruStage is operating in a clean and safe environment as systems return to service. The answer had read that TruStage continues to work closely with Mandiant as part of its ongoing investigation and recovery efforts, opening with “Yes.” It now says Mandiant “has not identified any threat actor activity within the environments in the scope” of its investigation since July 11, 2026, which TruStage describes as the date it first became aware of the incident and took measures to contain and remediate it. The link to Mandiant’s most recent investigation memo was unchanged at this check; TruStage repointed it to a newer memo on September 3.
What changed is which claim this page makes in its own voice. The words “clean” and “contained” now appear on the annuity page only inside the question; the answer no longer uses either, and no longer starts with an affirmative. Read that narrowly. TruStage has not withdrawn anything: its July 31 and August 13 newsroom releases still state that the incident is contained and that it built a clean, isolated environment, and on September 2 the same containment answer this page dropped was still published word for word on five other outage pages — credit union, business, wealth management solutions, preplanning, and retirement. Three of those five took the rewrite on September 3; see that day’s entry. What this page now offers is a narrower report of what Mandiant did not find, inside a scope Mandiant has not publicly defined.
The sentence itself is not new to TruStage. Its Canadian affiliate’s FAQ at trustage.ca has carried it since August 24, where it was added alongside the fuller “clean, contained, no indication of active intrusion” wording rather than in place of it. The annuity page is the first US surface to take the sentence, and the first anywhere to use it as a replacement.
Verified on the live page rather than from the snapshot alone. TruStage’s “Last Updated” stamp on the page did not move — it still reads September 2, 7:26 a.m. CT — so the edit is not visible from the page’s own date. This is the second silent change to this page today; the VULI and VULII allocation form arrived the same way this afternoon. For a credit union, nothing here changes service status or what to tell a member; it matters because it is the answer a member or an examiner is most likely to be pointed at when they ask whether the incident is over.
Trade press: CU Today reports TruStage has reopened its Claims Contact Center on 800-356-2644 for life, AD&D, lending, business protection and some annuity claims, citing a September 1 update sent to credit union partners. No TruStage page this tracker follows mentions the reopening.
CU Today reported on September 1 at 1:21 p.m. that TruStage has reopened its Claims Contact Center, citing an update the company sent to credit union partners the same day. According to that report, credit unions and members can call 800-356-2644 to report a claim, supply documentation, confirm that a claim filed after the outage was received, and get guidance, and the center is handling life, accidental death and dismemberment, lending, business protection and certain annuity claims. The report adds that TruStage has begun reviewing GAP claims filed after July 11, that credit insurance, debt protection and GAP claims continue to be accepted and processed, and that anyone who has already filed should not send a duplicate.
Two things in the report are not on any TruStage page this tracker follows. The first is the reopening itself: the phrase Claims Contact Center appears on none of the twenty-five surfaces swept at 2:01 p.m. Eastern, and the claims dashboard was byte for byte identical to the noon sweep. The number is public — 1-800-356-2644 sits at the foot of all three service dashboards — but it is published there as TruStage's general call line, with nothing identifying it as a reopened claims center. The second is a town hall: CU Today says President and CEO Terrance Williams will hold one for credit union partners in the coming weeks, and that the September 1 communication set no date. The report also describes a caution to credit unions that TruStage is not recommending replacement policies from other insurers, which likewise appears on no tracked page.
One point needs care. The report restates that most life and AD&D claims pending before the July 11 attack are expected to be paid by the end of next week. That is word for word what TruStage's own claims dashboard has said, unchanged, since August 28, so the report does not by itself settle which week is meant: read against the August 28 page it is the week beginning August 31, read as a fresh September 1 statement it would be the week beginning September 7. Nothing on TruStage's public pages has moved, so this record keeps its existing note anchored to August 28 until TruStage's own wording changes. The report also carries forward two caveats unchanged — TruStage still cannot give a timeline for an individual claim, and policy, beneficiary and ownership changes, cancellations and some disbursements still need manual or offline handling.
The remainder of the report matches material already published on TruStage's outage pages: recurring ACH and certain recurring card payments resuming for eligible life and AD&D customers on payment details already on file, coverage not being ended over payments missed during the disruption, one-time telephone payments and some paper billing still unavailable, and the standing warning that TruStage is not sending delinquency notices or asking for payment through unsolicited messages. The September 1 partner update itself is not public, so everything above rests on CU Today's account of it.
TruStage's wealth management page has replaced three period-by-period compensation answers with one: managed advisors and dual credit unions were paid as regularly scheduled for all of July and August, and July's estimated payments were recouped against actuals in August.
TruStage rewrote the compensation section of its wealth management solutions outage page between our 12:01 p.m. and 2:01 p.m. Eastern sweeps on August 31. The page's shared last-updated stamp did not move with the edit — it still reads August 31 at 7:50 a.m. CT from this morning's routine roll across the outage family — so nothing on the page signals that its content changed this afternoon. That is the same pattern seen on several earlier edits to these pages.
Three questions came off: how compensation to advisors and credit unions was calculated for the first half of July, for the second half of July, and for the first half of August. One replaced them, asking whether compensation has been paid during the outage. The answer says TruStage Wealth Management Solutions paid managed advisors and dual credit unions as regularly scheduled for all of July and August, and that estimates paid for July were recouped with the actuals in August.
Two things in that are new. The page previously covered only through the first half of August; it now states that compensation was paid as scheduled for the whole of both months. And the true-up is now reported as done rather than planned: the removed answer had said the July estimates would be reversed in August and offset against actual calculations, in the future tense, while the new one says in the past tense that the recoupment happened. For a dual credit union this is a payment it receives, so the completion is worth noting.
One detail was lost in the consolidation. The removed answers described how the estimates were calculated — an average of the last six pay periods for managed advisors, and for dual advisors the same average paid to the credit union. That description is no longer on the page, so a credit union reconciling an August remittance against a July estimate will not find the method there and should ask its account representative, which is what the page's closing line already directs readers to do. Nothing else on the page changed.
TruStage's main outage hub now opens with a recovery status summary — eleven claims, servicing and disbursement functions, all marked partially available — and links its three service dashboards for the first time. Its headline no longer says the company is investigating.
TruStage restructured the front of its outage hub between our 12:01 p.m. and 2:01 p.m. Eastern sweeps on August 31. The hub carries no last-updated stamp, so a snapshot comparison is the only way to date the change. The headline changed from a line saying TruStage was actively investigating a cybersecurity attack to one describing recovery status and online resources. The paragraph beneath it is unchanged, still dating the attack to July 11 and describing infrastructure being rebuilt rather than simply switched back on.
The substance of the change is a new block headed recovery status updates. It groups eleven functions under three headings: claims (submission, processing and payout), policy and contract servicing (one-time payments, recurring payments, managing a policy or contract, and cancelling one), and disbursements (one-time withdrawals, recurring withdrawals and surrenders). Every one of the eleven is marked partially available. Each group ends with a link to the matching dashboard at trustage.com/outage/claims-status, /policy-servicing-status and /disbursements-status. Those three dashboards have been published since August 20, but until now nothing on the hub pointed to them; the credit-union outage page was the only tracked surface that did, which meant a member arriving at the hub had no route to them.
One thing to read carefully: the summary is more favorable than the dashboard it links. The disbursements dashboard still carries unavailable as its own overall label, and for life coverage it lists one-time withdrawals and surrenders as unavailable, while the hub rolls all three disbursement functions up as partially available. The roll-up appears to be an across-products summary and should not be read as the status of any particular product. For a specific coverage, open the dashboard and read the product row and the note under it.
The resource links below the new block were re-marked-up as buttons rather than spelled out in sentences. That makes the reference to Mandiant's investigation memo look in a text comparison as though it were removed; it was not — the link is still in the page source and still points to trustage.com/mandiant-investigation-memo-081026. Worth noting for anyone following the hub: the button now labelled newsroom updates does not open a newsroom index but goes straight to TruStage's August 13 press release. All of this was confirmed against the live page after the sweep.
TruStage's consumer FAQ has replaced its earlier answer calling conclusions premature with the version already on all seven outage pages: the data analysis needs more time. Its claims answer now says claim payment activities have resumed and will keep expanding.
TruStage rewrote two answers on its consumer service-disruption FAQ and moved the page's status stamp to August 31 at 11:15 a.m. CT. The edit landed between our 12:01 p.m. and 2:01 p.m. Eastern sweeps. The outage-information page shares that stamp and carries the timestamp change alone.
The first rewrite closes a rollout this record has followed since August 26. The consumer FAQ now carries, word for word, the same data-investigation answer as all seven outage sub-pages: TruStage continues a comprehensive forensic and data-impact analysis with outside cybersecurity experts, establishing whether any information was accessed and how far any impact reaches requires extensive investigation and validation, the analysis is “expected to take additional time,” and if TruStage determines notifications are required they will be made through the appropriate channels. What went is the earlier framing — that it would be premature to draw conclusions about the scope or impact of the incident, and that the company did not want to speculate or get ahead of the facts. Since mid-August this page had kept that wording and appended the forensic paragraph beneath it; now the older text is gone. No finding about data has been reported either way.
The claims answer was reworked as well, from a single block into five short paragraphs. Most of the substance carries over: product-specific claim payment timelines are still not available, preplanning and funeral claims, GAP claims and debt protection and credit insurance benefits are named as areas where payment has restarted, and life and AD&D processing capabilities are still being restored with claims pending at the time of the outage taking priority over those received after it. Two things did move. The description of payment shifted from having begun paying claims to having resumed claim payment activities, and a new closing sentence says that as additional capabilities are restored TruStage will keep expanding claim payment activities and working through existing claims. No product, service or date is newly named as restored.
With this edit the earlier premature-and-speculate wording survives on one tracked surface: TruStage Life of Canada's service-disruption FAQ at trustage.ca, which still keeps it and appends the forensic paragraph. A separate one-sentence fragment of that older phrasing remains on the wealth management page, but it sits inside a different answer — about credit unions' own notification obligations — not the data-access answer. Both rewrites were confirmed against the live page after the sweep, where the older wording now returns no hits.
Trade press: CU Today reported on August 29 that TruStage says the July 11 attack affected its backup systems as well as its primary ones, and that Kirsten Garen has been named interim chief information officer to lead the recovery.
CU Today reported on August 29, under Ray Birch's byline, that TruStage has told credit union partners the attack identified July 11 reached its backup systems as well as the primary systems those backups exist to restore. President and CEO Terrance Williams is reported as saying the company must move faster on modernization and build alternate recovery paths, rebuilding capabilities on cloud technology, and as describing a need for "additional layers of resilience and independence" in how critical systems are protected and recovered.
The same report names Kirsten Garen interim chief information officer, leading the recovery and the company's resiliency work. Pat Lawicki, chief information officer since 2024, is reported to be staying on as a consultant. On the investigation side, PwC's cybersecurity team is reported to have joined Mandiant and Epiq Global, the two firms already named in this record, in supporting recovery and the data review.
Why it matters to a credit union: a backup estate caught in the same attack is the difference between restoring from a copy and rebuilding from scratch, and rebuilding is what TruStage has said it is doing. It offers context for a recovery now in its eighth week, and the added investigative capacity is consistent with a data review TruStage has said could take two to three more months, with credit unions notified first if data was affected — both points already recorded here from earlier reporting, as is the CEO town hall for credit union partners that TruStage has said it will hold without setting a date.
Verification notes. The August 29 byline date was read from the article itself, not from a listing. Everything above rests on CU Today's account of TruStage communications to credit union partners that are not public: none of the twenty-five surfaces this tracker sweeps carried the words Garen, Lawicki, PwC or backup at the September 4 noon check, so no tracked TruStage page corroborates the report. The article also described a detailed progress report the chief administrative officer had scheduled for Monday, August 31; this record does not treat that as having occurred.
Superseded. On August 28 TruStage's claims dashboard said it expected most pre-outage life and AD&D claims to be paid by the end of next week — its first product-level timing after the mid-August target was edited out. The undated sentence stood unchanged until TruStage removed it on September 11.
Removed September 11. The sentence below was never re-dated or restated; TruStage deleted it from the claims dashboard in its September 11 rewrite, replacing it with a dollar total and no date. What follows is the record of what the dashboard said for the two weeks it stood.
TruStage rewrote three product rows on its claims restoration dashboard on the afternoon of August 28; the snapshot pair places the edit between our 4:01 p.m. and 6:01 p.m. Eastern sweeps. Each rewritten row now carries a blue “New” badge — the first time any row on any of the three dashboards has been marked that way since TruStage published them on August 20. The page carries no “Last Updated” stamp, so those badges and a snapshot comparison are the only way to date the change.
The life row now says most pre-outage life claims are expected to be paid by the end of next week, with the remaining claims requiring additional documentation, and that processing and payment capabilities continue to expand. The accidental death and dismemberment row says the same for pre-outage AD&D claims, with some claims needing additional documentation before payment can be completed. The payment protection row — credit insurance, debt protection and GAP — says claims continue to be accepted and processed and that review of GAP claims submitted after July 11 has begun as additional claims capabilities are restored; July 11 is the date TruStage gives for identifying the attack, so this reads as claims filed during the outage entering review. All three rows previously said only that TruStage's ability to process and pay claims was actively being restored.
This is the first product-level payment timing TruStage has published since it edited its mid-August operational target off the last of its outage pages on August 27, and the first timing of any kind on the dashboards, which otherwise state availability without dates. Read it for exactly what it says. It is an expectation about most claims in two product lines, not a statement that those claims have been paid, and the claims needing further documentation sit outside it. Because the page prints no publication date, “next week” is relative to a date TruStage does not give; read on the afternoon of August 28 it points at the week beginning August 31.
No availability label moved with the wording: submission, processing and payout remain partially available for life, AD&D and payment protection alike. The three rewritten rows were confirmed on the live page after the sweep, and the annuities row still carries the older “actively being restored” wording — so this was a targeted edit to three products, not a template change across the board.
TruStage's retirement outage page now carries the rewritten data-investigation and recovery answers, the last of its seven outage pages to take them. It says the data analysis needs more time and that many critical capabilities are already back; no retirement service is newly named as restored.
TruStage rewrote two answers on its retirement outage page on the morning of August 28, between our 10:01 a.m. and 12:01 p.m. Eastern sweeps, and moved the shared “Last Updated” stamp on that page and the five other dated outage pages to August 28 at 10:01 a.m. CT. On those five other pages the stamp line is the only thing that changed; the retirement page is the one that was actually edited.
The data-investigation answer was replaced rather than added to. Where it had said conclusions about the scope or impact of the incident would be premature and that TruStage did not want to speculate or get ahead of the facts, it now says TruStage continues a comprehensive forensic and data-impact analysis with outside cybersecurity experts, that establishing whether any information was accessed and how far any impact reaches requires extensive investigation and validation, and that the analysis is “expected to take additional time.” The answer appears twice on the page — once in the participant FAQs and again in the plan-sponsor FAQs — and both copies were replaced. The wording also shifted from the first person to the third: the closing sentence now says that if TruStage determines notifications are required, those communications will be made through the appropriate channels.
The recovery answer took the version already carried on four other outage pages. It describes a deliberate, phased recovery, says systems and applications are being restored carefully so they are secure, stable and checked before going back into service, says many critical capabilities have already been restored with more functionality coming online, and says some capabilities will need additional time. Neither rewritten answer names a service, attaches a date, or reports any finding about data.
With this edit all seven outage sub-pages carry the rewritten data answer, and the earlier premature-and-speculate wording survives on just two tracked surfaces — the consumer FAQ and the Canadian FAQ — both of which keep it and append the forensic paragraph rather than replacing it. Nothing else on the retirement page moved: plan balances and benefits are still described as unaffected, BenefitsForYou.com is still down with interim phone processes in place, and the Retirement Service Center (844.999.2677) and Participant Service Center (800.999.8786) numbers are unchanged. Confirmed against the live page, where the older wording now returns no hits.
TruStage's Canadian affiliate rewrote its FAQ: pre-authorized bank billing has resumed for some customers, claims and new-business intake now route through General Agents, and claims came off the unavailable-services list. Canadian scope only — no tracked US surface changed in the same sweep.
TruStage Life of Canada rewrote much of its service-disruption FAQ at trustage.ca between our 8:01 a.m. and 10:01 a.m. Eastern sweeps on August 28. It is the largest edit to that page since it entered the sweep on August 24. The page still carries no Last Updated stamp, so the change is visible only by comparing snapshots, and its status line still reads Investigating.
Four new answers cover billing. TruStage says pre-authorized debit and electronic funds transfer billing activity has resumed for certain customers as part of its phased recovery, and that some customers may therefore see a regularly scheduled premium drafted even though an earlier one went unprocessed during the outage. Representatives still cannot see individual account information or determine the status of a specific premium payment. TruStage states plainly that billing restoration does not mean all systems are back, and warns that customers may hit delays or processing exceptions as services return. The list of unavailable services was rewritten at the same time: claims came off it, and billing changes and payment over the phone were added.
The claims answer changed shape. Where the page previously said a death claim arising during the outage would be processed and paid under the policy terms once TruStage was able, it now tells funeral homes to work with their General Agent to submit the initial notification of loss, and tells beneficiaries to notify the funeral home associated with the policy. It says some claim processing limitations remain but that it expects to handle more claims as functionality returns. The partner answer on new business moved the same way: TruStage says it has stood up temporary capabilities to take in the backlog of new business applications, and points partners to their General Agent for current submission and processing guidance.
On the data question the Canadian page caught up with the US pages rather than moving past them. The older wording — that conclusions are premature and the company will not speculate — is still there, with the same forensic and data-impact paragraph the US consumer FAQ and retirement page have carried since mid-August now appended to it; the question's heading was also corrected from "comprised" to "compromised." No finding has been announced. Read the whole edit narrowly: this is TruStage Life of Canada describing Canadian products and Canadian service, and none of the tracked US surfaces changed in the same sweep. The page also picks up the anti-fraud line already on the US pages — TruStage is not sending past-due notices or premium-payment requests, and a message claiming otherwise should not be clicked, answered with personal information, or paid.
The wealth-management page was the last TruStage outage page still promising key processes operational by mid-August. That answer was replaced on the afternoon of August 27 with undated, phased-recovery wording, and no new completion date was given. TruStage now states no public recovery target anywhere on its outage pages.
TruStage rewrote two answers on its wealth management solutions outage page on the afternoon of August 27; the snapshot pair places the change between our 2:12 p.m. and 4:01 p.m. Eastern sweeps. The page's "Last Updated" stamp did not move — it has read August 27 at 7:11 a.m. CT since the morning, so the edit is visible only by comparing the text.
The significant change is the recovery answer. Until this afternoon this page still told readers that TruStage rebuilt parts of its infrastructure and "anticipate that the majority of key processes will be operational by mid-August." It was the last outage page carrying that target as a live answer; TruStage had been removing it page by page since August 18. The replacement is the same four-sentence, undated wording now used across the outage family: recovery is deliberate and phased, systems are validated as secure and stable before returning to service, many critical capabilities have already been restored with more coming online, and some capabilities will require additional time.
What matters for a credit union is what did not replace it. No new completion date, no revised target, and no named service. TruStage has not withdrawn the mid-August commitment in words — it has edited it out, and now publishes no recovery target at all on these pages. The phrase survives only in dated historical material: the July 31 and August 13 newsroom releases, which stay posted as records, and the CEO video transcript on the credit-union page. Staff asked when TruStage expects to be done should say there is no public target date rather than repeating mid-August.
The same edit also carried the rewritten data-investigation answer onto this page, saying the forensic and data-impact analysis is expected to take additional time. That rollout now covers six outage pages; the older wording remains on the consumer FAQ, the Canadian FAQ, and the retirement page. No finding on whether any data was accessed has been announced.
TruStage's credit-union page now carries the two answers rolled out elsewhere this week: the data-impact analysis needs more time, and many critical capabilities are already restored. Its claims wording was firmed up as well, but no service is newly named as back.
TruStage refreshed the credit-union outage page — the one written for our members — on the morning of August 27, and moved the “Last Updated” stamp on it and the five other dated outage pages to August 27 at 7:11 a.m. CT. The edit landed between our 8:01 a.m. and 10:02 a.m. Eastern sweeps. This is the first stamp movement in several days, and unlike several earlier edits the stamp moved together with the content rather than lagging behind it.
Both answers our August 26 items flagged as missing from this page are now on it. The data-investigation answer says TruStage continues a comprehensive forensic and data-impact analysis with outside cybersecurity experts, that establishing whether any information was accessed and how far any impact reaches requires extensive investigation and validation, and that the analysis is “expected to take additional time.” The recovery answer says systems are being restored carefully and validated as secure and stable before returning to service, that many critical capabilities have already been restored with more coming online, and that some capabilities will need longer. Neither answer names a service or attaches a date, and neither reports a finding on data. The data-investigation rewrite reached the preneed page in the same edit, putting it on four pages as of this check. Around midday on August 27 TruStage carried both rewritten answers onto the individual outage page as well, in wording identical to the version here, leaving the consumer FAQ, the Canadian FAQ, and the retirement and wealth-management pages on the older answer.
The claims section opens with new wording: claims payment activities have resumed across several areas of the business, and TruStage continues working through backlogs while expanding capabilities and reducing service disruptions. Read against what it replaced, this is a firmer framing rather than fresh news. The sentence that follows is unchanged — TruStage has started paying preplanning and funeral, GAP, and debt protection and credit insurance claims — and the page's Life and AD&D answers still say pre-outage claims come first and that the backlog will take time. Nothing on the page is newly identified as restored, and the three service dashboards were unchanged at this check.
One piece of member guidance came off the page. The direct-mail answer used to add that no further new mailings would go out in August, that some members might still receive Life direct-mail offers already in progress before the attack, and that licensed AD&D and life call-center agents remained available to help those members complete the mailed application. That paragraph is gone, and the answer now says only that TruStage plans to direct-mail Auto Insurance offers for the month of August. TruStage gave no reason for the removal. The separate answer telling members that new AD&D and Simple Issue life applications must be filed on the paper form TruStage mailed is still there and unchanged.
The remainder of the edit is housekeeping: the lending questions were reordered, “Debt Protection,” “Term Life Insurance” and “Whole Life Insurance” were capitalized, and “You can review the technical FAQs” became “Please review.” The link behind that phrase still resolves to TruStage's outage-information FAQ page. Every change here was confirmed against the live page rather than the extracted snapshot alone.
TruStage's business outage page now says many critical capabilities have already been restored and more keep coming online — its firmest recovery language so far, though it still names no service and gives no completion date. The page also picked up the rewritten data-investigation answer first seen on the annuity page two hours earlier.
TruStage rewrote two of the four answers in the outage FAQ on its general business page during the evening of August 26; the snapshot pair places the change between the 4 p.m. and roughly 7 p.m. Eastern sweeps. The page's “Last Updated” stamp did not move for either edit.
The recovery answer is the new part, and it has not appeared anywhere else yet. Asked when the incident will be resolved, TruStage previously gave two sentences that restated the intro at the top of the same page: the attack was broad, parts of the infrastructure were rebuilt, and systems were coming back through a phased approach. The replacement runs four sentences and adds a claim the older answer did not make — that “Many critical capabilities have already been restored,” with additional functionality continuing to come online. It also says systems are being validated as secure and stable before they return to service, and that some capabilities will need more time.
Read it for what it does not say. No service is named as restored, no date or target is attached, and the closing sentence still holds open that some capabilities are not back. It is a firmer description of the same phased recovery rather than an announcement that anything specific is working again, and a credit union should not treat it as confirmation that a particular process has returned. It does sit consistently with what TruStage told partners through trade press on August 21, when contact centers were reported handling more than 42,000 calls.
The second edit is the data-investigation answer that first appeared on the annuity page in the afternoon, saying the forensic and data-impact analysis is expected to take additional time and dropping the earlier language framing conclusions as premature. Its arrival here confirms the rewrite is being rolled out page by page rather than published once. As of this check it stands on two pages, the annuity and business pages, while the consumer FAQ, the Canadian FAQ, and the credit-union, individual, preneed, retirement and wealth-management outage pages all still carry the older wording. That matters for our members in particular: the credit-union outage page, the one written for them, still shows the previous answer to both questions.
Neither edit moved the page's stamp, which still reads August 26 at 8:01 a.m. CT — the same value it carried at the 4 p.m. check, before either change existed. Both edits were confirmed against the live page rather than the extracted snapshot alone.
TruStage still reports no finding on whether any data was accessed, but its annuity page now says the analysis needs more time, dropping earlier language that framed conclusions as premature. The older answer still stood on its other outage pages at the same check.
TruStage rewrote the answer to its outage FAQ on when it will know more about whether data was compromised. The change appeared on the annuity page between 2 and 4 p.m. Eastern on August 26. The new answer says the company continues a comprehensive forensic and data-impact analysis with outside cybersecurity experts, that determining whether any information was accessed and understanding the scope of any potential impact requires extensive investigation and validation, and that because of the complexity the analysis is “expected to take additional time.” It repeats that where notifications are determined to be required, those communications will be made through the appropriate channels.
No finding has been announced. The answer still reports no determination about whether any data was accessed, and it attaches no date. What moved is the framing. The previous version treated any conclusion as premature at this stage, said the company would not speculate ahead of the facts, and described the work as something that may take time. Those sentences are gone, the replacement speaks of TruStage in the third person rather than the first, and it states the additional time as an expectation rather than a possibility. Set against the two-to-three-month estimate trade press reported from TruStage's August 12 update, it points the same way: the data question stays open for a while yet.
Two notes on scope. The rewrite is on the annuity page only so far. At the same 4 p.m. check, the consumer FAQ, the Canadian FAQ, and the business, credit-union, individual, preneed, retirement and wealth-management outage pages all still carried the older wording, so a credit union reading any of those today will see the previous answer. TruStage also made the edit without moving the page's “Last Updated” stamp, which still reads August 26 at 8:01 a.m. CT — the same stamp the page carried two hours earlier without this content. That is a recurring pattern on these pages and a reason not to rely on the stamp to tell you whether a page has changed.
The same edit added one form to the annuity owner resources: a qualified charitable distribution form, filed under withdrawals and surrenders, for contract owners directing an eligible distribution to a charity. It joins the required minimum distribution, systematic withdrawal, partial withdrawal, surrender and direct deposit forms already published there. The forms are reached from the annuity outage page linked above.
Recurring credit card premiums began drafting again on August 20, the second payment method to come back, and TruStage says nobody was double-drafted to cover a payment missed during the outage. One-time and paper billing are still down. Three new answers matter at the branch: members who blow past their GAP skipped-payment limit because a claim was slow will get those months counted anyway, new AD&D and Simple Issue life applications can only be filed on a paper form TruStage mailed, and policy-conversion deadlines will be extended.
TruStage rewrote the billing and claims sections of its credit-union outage FAQ on the evening of August 25; the snapshot pair places the change between the 4 p.m. and 8 p.m. sweeps. It is the first substantial rewrite of this page since August 19, and it moves the payment story forward for the first time in two weeks.\n\nBilling: TruStage says it began drafting recurring credit card payments on August 20, and that as with the earlier ACH restart no customer was double-drafted to make up a payment missed during the outage. Recurring monthly ACH and now card billing are described as resumed for certain life, AD&D and preplanning customers. Paper billing and one-time payments are still unavailable and described as actively being worked on — so the picture is now two recurring methods back and the manual ones still down, where every earlier version of this page had card payments in the same unavailable bucket as one-time. Representatives still cannot verify an individual customer's payment activity. Billing questions are now routed to the individual service hub at trustage.com/outage/individual rather than to unnamed support resources, which is a more useful answer for a member service representative fielding the call.\n\nClaims: the page states that claim payments are underway across preplanning and funeral, GAP, and debt protection and credit insurance. For life and AD&D, core claims processing is still being restored, and TruStage says it will clear claims that were already pending when the outage began before turning to those filed since, cautioning that the backlog will take time. Members can file a first notice of loss at trustage.com/startclaim and get an email confirmation, after which a claims representative contacts whoever submitted it.\n\nThree answers are new and have direct operational consequences for a credit union:\n\nGAP skipped payments. Where slow credit insurance or debt protection claims processing pushes a member past the number of skipped payments their GAP contract allows, TruStage will still count those extra months in the protected balance on a later total-loss GAP claim. It sets the allowance at one additional skipped payment per month the outage runs, using a three-month outage yielding three extra payments as its own example. This is the first accommodation TruStage has published that changes how a contract term will actually be applied, rather than promising a process will return.\n\nNew life applications. Members wanting new AD&D, Simple Issue Term or Simple Issue Whole Life coverage can apply only by returning the paper application from a TruStage direct mail offer. TruStage says these cannot currently be started through its call center or on trustage.com. A member without a mailed offer therefore has no route to these products right now — worth knowing before a branch refers someone. Auto and home is the exception and continues normally through Liberty Mutual and Polly for quotes, purchase, servicing and claims.\n\nConversion deadlines. TruStage says members will not lose coverage because the disruption stopped them acting on a policy, and that it will extend deadlines for policy conversions as processing resumes. That answers a question staff have had since term-conversion notices kept arriving through the outage.\n\nTruStage also says it is still building the processes to capture the GAP and mechanical repair coverage data collected through the workaround and to issue those member contracts, with timing to be announced. The page picked up a browse-topics navigation splitting it into billing and payments, lending products, other products and about the outage. It remains undated, so there is no stamp on the page to tell a reader any of this is new.
Three TruStage annuity registrants filed prospectus supplements dated August 24 telling contract owners which transactions are running again on interim processes — eleven of them, including Section 1035 exchanges, rollovers to an IRA and death benefit claims. TruStage also commits to treating applications that were pending when the outage began as though they had been issued on their original date, crediting rates and income benefit terms included, and says most financial transaction requests received since the outage began have now been processed.
TruStage's annuity subsidiaries used a regulatory channel on August 24 to give contract owners the most specific servicing picture yet published. Four versions of a prospectus supplement, all dated August 24, were filed across three registrants — MEMBERS Life Insurance Company (CIK 1562577), the MEMBERS Horizon Variable Separate Account (CIK 1651981) and, appearing in this record for the first time, the CMFG Variable Annuity Account of CMFG Life Insurance Company (CIK 916873). Between them they cover the MEMBERS Zone, MEMBERS Horizon and TruStage Horizon II variable annuities; the TruStage ZoneChoice, ZoneChoice Advantage, Zone Income and ZoneChoice Income index-linked annuities; and the older MEMBERS Variable Annuity, II, III and Choice contracts.
Every version lists the same core set of eleven transactions now supported by interim processes: subsequent purchase payments, systematic withdrawals, partial withdrawals, surrenders, starting lifetime income payments under an income benefit rider, direct deposit changes, transfers among allocation options, changes to allocation instructions, death benefit claims, Section 1035 exchanges into a contract at another insurer, and rollover distributions to an IRA, Roth IRA or retirement account. The last two are worth noting for credit unions fielding questions, because neither the 1035 exchange path nor the rollover path appears anywhere on TruStage's public outage pages.
Two commitments in the filings are new to this record. TruStage says applications it had received in good order before the outage will be treated — in its words — "as if they had been issued" on the date they would otherwise have been issued, and that this carries the Risk Control Account crediting rates and income benefit terms that would have applied. It also states that most requests for financial transactions received in good order since the outage began have been processed, and names what is still queued: allocation changes to Risk Control Accounts at the end of an interest term for the newer contracts, and loans and loan repayments for the older CMFG contracts. Non-financial requests such as address and ownership changes are described as processed when administratively possible.
The version filed for buyers holding an initial summary prospectus for the four ZoneChoice and Zone Income products adds two rights the other versions do not mention: an applicant may cancel a pending application and have the premium refunded, and an owner of a recently issued contract may cancel under the right-to-examine privilege and receive a refund of premium or contract value as their state requires, with the contract value reflecting investment performance including the interim value of anything allocated to Risk Control Accounts. That version also says plainly that the event affected TruStage's ability to take in new contract applications, not just to service existing ones.
The filings restate what TruStage's annuity outage page already tells members — that contract values, account balances and benefits were not affected, that requests are date- and time-stamped on receipt and processed in prospectus order, and that forms are at trustage.com/outage/annuity or can be mailed to Waverly, Iowa. One detail cuts against a discrepancy this tracker flagged on August 20: the supplements give the annuity call center as 800-798-5500, the number on TruStage's policy servicing dashboard, rather than the 855-591-9027 still printed on the annuity outage page. TruStage has still not said which number it intends contract owners to use, and a filed document using one of them is not a statement that the other is wrong.
What this is not: it is not a data-exposure finding. The supplements repeat that TruStage is still investigating the scope and impact of the event, and say nothing about whether information was accessed.
TruStage Life of Canada, a separately regulated Canadian insurer, runs its own incident FAQ at trustage.ca. It is the first surface in this record showing the incident reached a TruStage affiliate outside the United States, and the first place TruStage says plainly that it has filed all required regulatory notices and is in regular contact with its regulators, including Assuris. Both statements are about the Canadian company and its Canadian regulators only — they say nothing about whether any US notification has been made. The page's service status is its own and does not describe US operations.
TruStage Life of Canada — the entity that underwrites and administers TruStage Preplanning Solutions products in Canada — publishes a service-disruption FAQ on TruStage's Canadian domain. Nothing on any tracked US surface points to it; it was found by search. It is now part of the snapshot sweep, so future edits will be caught.
Why it matters for a credit union here is scope, not service. This is the first evidence in this record that the incident reached a TruStage affiliate outside the United States, operating under a different regulator. The page says TruStage Life of Canada is a federally regulated insurer, that it has been in regular contact with its regulators throughout the outage including Assuris, which backstops Canadian policyholders, and that it has filed all required notices and continues to meet its regulatory obligations. That is the most direct statement TruStage has made anywhere public about having actually filed with a regulator. Read it narrowly: it is the Canadian company describing its own Canadian filings. It is not a statement that any US federal or state notification has been made, and it is not a finding that data was affected — the same page still calls it premature to draw conclusions about scope or impact, including whether any data was accessed.
The service picture is Canadian and does not track the US pages. At this August 24 check the FAQ's status line read Investigating, and it listed policy cancellations, policy information updates, withdrawals and loans, policy values and quotes, policy changes, and claims as unavailable — a step behind the US posture at the time, where TruStage had been paying claims across several lines for weeks. The page carries no Last Updated stamp, so there was no way to tell from it whether the Canadian operation was genuinely further back or the page had simply not been refreshed, and TruStage has not said which. Nothing here should be read as a change to US service status. TruStage rewrote much of this page on August 28, including that list and the claims answer; the August 28 item carries what it says now.
On money and coverage the Canadian guidance is reassuring and specific: active and grace-period policies hold their status until normal payment processing resumes, applicable grace periods will be extended afterward, recurring credit card and mailed payments are still processing, and pre-authorized bank withdrawals are starting again though possibly off their usual dates. Review periods will be extended where needed. As of this check a death claim arising during the outage would be processed and paid under the policy terms once TruStage was able — wording the August 28 rewrite replaced with a funeral-home and General Agent process — and business written but not yet processed will be honoured if the policy was otherwise issuable and there are no contestability concerns. The Canadian service line is 1-888-977-3752, weekdays 8:00 AM to 5:00 PM CT, and representatives currently cannot reach policy or account information.
Two further points worth carrying. The FAQ states that TruStage is not encouraging or taking part in any effort to replace, surrender, or discontinue in-force coverage because of the incident, so an unsolicited replacement offer is not coming from TruStage — the same fraud-awareness message credit unions have been giving members. And it restates the Mandiant findings already in this record: that the operating environment is "clean, the incident is contained," with no indication of active intrusion and no threat-actor activity seen in the environments in scope since July 11, 2026, with the investigation and recovery still under way.
Note on sourcing: the page carries TruStage's standard proprietary-and-confidential footer, but the rights holder published it publicly on its own domain and directs customers to read it, so the 2026-08-11 carve-out applies and the URL is cited normally. A French counterpart exists and is not yet tracked.
Trade press: TruStage told partners that its Retirement, Consumer Insurance, Annuity and Pension Risk Transfer contact centers are operating and have taken more than 42,000 calls since August 13, with ACH billing, pre-outage GAP claims and most retirement withdrawals, loans and rollovers restored.
CU Today reports on a Friday afternoon update sent to credit union partners by Chief Administrative Officer Greg Holman, describing a shift from rebuilding foundational infrastructure toward improving customer experience and widening the set of available services. Contact centers for Retirement, Consumer Insurance, Annuity and Pension Risk Transfer are described as operating, having handled more than 42,000 calls since August 13, with billing, payment and policy questions making up most of the volume. Monthly ACH consumer billing has resumed across multiple products and payment methods, and policies stay active while missed payments and other payment problems are worked through.
On claims and retirement, the report says processing has restarted for pre-outage GAP claims, for recurring debt-protection and credit-insurance benefits at higher-volume credit unions, and for select life claims, with both pending and newly submitted claims being worked. Most defined-contribution participants can now request withdrawals, loans and rollovers and retrieve pre-outage account balances, and certain annuity death-claim processing has resumed. TruStage repeats that annuity and retirement plan assets were not affected. An interim digital portal that opened August 19 lets most 401(k) clients submit payroll contributions electronically, processed in payroll check date order as the backlog clears.
Much of this is corroborated by TruStage's own pages captured in the same sweep. The credit union outage page states that claim payments have started across preplanning and funeral, GAP, and debt protection and credit insurance, and that recurring debt-protection benefit payments are being prioritized for the credit unions with the highest volumes; the retirement page confirms an interim payroll submission path; the annuity page shows its contact center open weekdays, 8:00 AM to 5:00 PM CT. The 42,000-call figure and the August 19 portal date appear only in this report and on no TruStage public page as of capture.
One element is carried as reported rather than verified. The article relays that TruStage told partners A.M. Best has affirmed its A (Excellent) financial strength rating; a fresh affirmation dated this week could not be independently confirmed, and A.M. Best's own public statement on the incident, issued August 7, said the company's credit ratings were unchanged. Those may or may not be the same thing, so the rating point should not be repeated as a new development. TruStage's own framing stays cautious: the company says it has "not reached the finish line."
TruStage has canceled Discovery 2026, its credit union conference set for August 27, saying its focus must remain on recovery. Key content moves to a thought-leadership series in the coming months. The notice addresses neither existing registrations nor refunds.
TruStage's Discovery conference page now carries a cancellation notice that ties the decision directly to the incident, saying that because of the cybersecurity attack affecting certain TruStage systems and services, "Discovery 2026 has been canceled." The company adds that key Discovery insights and strategic content will instead be shared through a new thought-leadership series in the coming months. The conference had been scheduled for August 27.
This is the first point at which the incident's effects reach TruStage's event calendar rather than a service line, and for credit unions it is a scheduling question rather than a servicing one: staff who were registered, booked travel, or built August plans around the event are affected directly. The notice says nothing about existing registrations, refunds, or travel already arranged, so a credit union with people booked will need to take that up with TruStage.
Dating note: TruStage's own page carries no date for the notice. The 08/22/2026 line at the top of the page is site chrome that rolls at UTC midnight across the whole trustage.com template, not a content date, and it should not be read as the announcement date. The cancellation was first reported publicly on August 20 by CU Times and covered on August 21 by CU Today, so this item is dated to the earliest public report.
Coverage note for staff: this page sits outside every surface the tracker sweeps. It is not under /outage/, and the newsroom sitemap enumeration only retains /newsroom/ URLs, so nothing in the automated sweep would have surfaced it — it was found through a search. It has been added to the snapshot page list so any follow-up notice, including anything about registrations or refunds, is caught automatically.
TruStage's servicing dashboard now names a contact center and number per product: life and AD&D 1-800-779-5433, retirement 1-844-999-2677 (plan sponsors) and 1-800-999-8786 (participants), annuity advisors 1-877-345-4769. It gives annuity customers 1-800-798-5500, while TruStage's annuity outage page still gives 855-591-9027.
TruStage rewrote the contact guidance on its policy and contract servicing dashboard this afternoon. Where each product block previously told customers to "contact us using the phone number listed at the top of the page," the blocks now name a specific contact center and print its number: the Life and AD&D Contact Center at 1-800-779-5433 for life and AD&D policy questions, 1-877-345-4769 for annuity advisors and 1-800-798-5500 for annuity customers, and, for retirement, 1-844-999-2677 for plan sponsors and 1-800-999-8786 for participants. The generic 1-800-356-2644 that had sat at the top of all three status dashboards was removed at the same time; it remains only in the site footer's general "give us a call" block for licensed agents, which is a sales line rather than a servicing one.
No availability status changed on any of the three dashboards in this update. Claims and disbursements were otherwise untouched apart from a heading rename and formatting, so this is a change to how a credit union or member reaches TruStage, not to what TruStage can currently do.
One discrepancy is worth flagging rather than smoothing over: the servicing dashboard gives annuity customers 1-800-798-5500, while TruStage's annuity outage page continues to give 855-591-9027 for the same Annuity Contact Center. Both numbers are live on TruStage pages as of this afternoon and both carry matching click-to-call links, so neither is a typographical artifact. The 1-800-798-5500 line is also the number published on TruStage's standing annuity help pages outside the outage; 855-591-9027 was added to the annuity outage page on August 18, replacing an earlier 855-798-5500 within hours. TruStage has not said which number it intends annuity contract owners to use during the outage, and we are not inferring one — the annuity outage page remains the incident-specific surface, so we continue to list 855-591-9027 first while noting the dashboard's number alongside it.
Verification: every number above was read from the visible page text and confirmed against its click-to-call link. A similar-looking 1-855-591-9026 appears in these pages' underlying site-wide markup but is not offered to readers as a contact number.
TruStage now publishes its own availability board, service by service. Most claims and servicing functions are marked partially available; annuity claim payouts, Payment Guard servicing and life withdrawals and surrenders are marked unavailable; mechanical repair coverage and brokered commercial products are marked fully available. Check the dashboards directly — they carry no date stamp, so yesterday's reading may no longer hold.
On the morning of August 20 TruStage replaced the opening of its credit union outage page with a recovery board and published three new status pages behind it — one for claims, one for policy and contract servicing, one for disbursements — reached from that board or from the tabs at the top of each page. This is the first time the company has stated availability product by product and function by function rather than in prose. Its business outage pages were restamped to August 20 at 11:25 a.m. CT and its consumer pages to 11:15 a.m. CT in the same window.
The board on the credit union page rolls everything up to partially available across all three categories, but the detail pages are far more useful than that summary. Claims for life, accidental death and dismemberment, payment protection — which TruStage groups as credit insurance, debt protection and GAP — Payment Guard and the bond suite are all marked partially available for submission, processing and payout. Mechanical repair coverage claims run through Assurant and are marked fully available, as are claims on brokered commercial products including cybersecurity protection, which stay with the carrier, agent or broker. Annuity death claims can be submitted and processed, but payout is marked unavailable.
Policy and contract servicing is mostly partially available, with two exceptions worth flagging for your staff. Payment Guard servicing is marked unavailable across payments, policy changes and cancellation, with an email address given for questions. Bond suite servicing is unavailable for payments and policy changes, with cancellation partially available. Annuity one-time and recurring payments and contract cancellation are marked available. On disbursements, annuity one-time withdrawals, recurring payments and surrenders are all marked available, retirement is partially available, and life withdrawals, loans and surrenders are marked unavailable — though the request forms can still be reached.
Two cautions. The dashboards carry no last-updated stamp of their own, so nothing on the page tells you when a status last moved; we now capture all three every cycle and will log changes here. And the three labels are TruStage's own — partially available covers everything from a working interim form to a queue that is simply moving slowly, so the note under each product matters as much as the label above it.
Defined contribution plans that do not use TruStage's Choice Group Variable Annuity now have an interim way to submit payroll, and the eligible plans were contacted directly. The same edit confirms BenefitsForYou.com was taken down deliberately, and softens the distribution instruction to checking whether a withdrawal is available at all.
TruStage rewrote parts of its Retirement Solutions outage page on the evening of August 19 without advancing the page's own “Last Updated” stamp, which still reads 9:17 a.m. CT that morning.
Two changes carry weight. A new participant question, on what services are unavailable, states on this page for the first time that BenefitsForYou.com was taken offline deliberately as a security measure, so participants cannot sign in to view an account or request a transaction. It says interim processes let some participants call for balance information, request a withdrawal or loan form, and request investment or allocation changes, and that the participants who can use those processes were told so directly by TruStage or by their employer. TruStage says it is still working on interim solutions for the remaining plans.
Second, the plan sponsor section now says an interim process to submit payroll is available for defined contribution plans that do not use TruStage's Choice Group Variable Annuity, and that the plans eligible to use it were contacted separately. That replaces the earlier statement that TruStage was still working on such a solution. A bullet immediately above it still says processing payroll files other than third-party aggregator submissions remains unavailable, so the page presently carries both statements; read the newer bullet as the narrower, current one.
One line moved the other way. Participants seeking distributions and loans are now told to email the participant service center “to determine whether withdrawals are available,” where the page previously told them to email that address to make the request.
The page credit unions are told to work from no longer promises most key processes by mid-August; it now describes an undated, phased recovery, matching the consumer and retirement pages. Seven new billing answers explain why billing was restored ahead of claims payments, and a new lending section consolidates the interim CI, DP, GAP and MRC guidance. The recurring Debt Protection process no longer publishes the six-or-more threshold that told a credit union whether it was included. The edit carries no date stamp.
Between the 8 a.m. and 10 a.m. sweeps on August 19, TruStage substantially rewrote the credit-union outage page — the page it tells credit unions to work from. It is the first change to that page's content since August 13, and the page carries no last-updated stamp, so nothing on it signals that an edit happened; this tracker caught it by comparing snapshots. The page grew by roughly forty percent. Its question sections were relabeled and reordered: the section headed Outage questions is now headed About the outage, the section headed For credit union leaders is now headed Billing and payments, and two new sections, Lending products and Other products, were added.
The most consequential edit is a removal. The answer to when this will be resolved previously ended by anticipating that the majority of key processes would be operational by mid-August. That sentence is gone. The answer now describes bringing systems and applications back through a deliberate, phased recovery and continuing to make progress, with no date attached. This is the same edit TruStage made to its consumer outage page on the morning of August 18 and its retirement page that afternoon. Three of the five outage pages that carried the target have now dropped it; the business hub and wealth-management pages still carry it, as do the August 13 and August 14 newsroom releases. The target also survives inside the CEO video transcript embedded further down this same page, so a credit union can still read the mid-August promise on the page that has just abandoned it.
On the data question TruStage holds its position that conclusions about scope or impact would be premature, but the answer is now longer. It says a comprehensive forensic and data-impact analysis is under way with the assistance of outside cybersecurity experts, that the complexity of that work means it may take time to determine what information, if any, was affected, and that if it concludes notifications are required it will communicate “through the appropriate channels.” That language reached the consumer page on August 18; this is the first time it has appeared on the partner-facing page. No interval is attached to it. The two-to-three-month estimate reported in mid-August is still a partner and trade-press figure rather than something stated on this page.
Billing is where the page adds the most. Seven answers are new. TruStage says recurring ACH billing activity has resumed for certain Life, AD&D and Preplanning customers as part of the phased recovery. It answers directly why billing came back before claims payment capability: different services need different controls and validation before they can be restored safely, and the ability to pay premiums and keep coverage in force was the concern customers raised most often. It draws the limit explicitly — billing restoration is one step and does not mean systems are back online — and warns that customers may hit delays or processing exceptions as services return. It explains why a customer may see an August premium drafted when a July premium was not: recurring payments are restarting from details already on file. It repeats that representatives cannot see individual account information or determine the status of a specific payment. And it tells credit union staff what to say when a member calls about billing activity, which is to point them to available customer support.
A new Lending products section consolidates operational guidance that had largely lived in TruStage's partner materials rather than on this page. Credit unions whose data processor submits monthly Credit Insurance or Debt Protection files need do nothing; those that submit directly should hold their files, and all should retain monthly premium reports, until TruStage says receipt and processing are restored. GAP waivers and mechanical repair certificates issued under the approved outage procedures will be honored. Credit Insurance, Debt Protection, GAP and mechanical repair coverage will not be canceled for non-payment during the disruption. A first notice of loss process is available while claims payment capability is being restored, and mechanical repair claims are unchanged, going to Assurant, which can pay the repair facility directly. Member-level Credit Insurance and Debt Protection cancellations still work, and where a refund is needed the credit union may issue it and submit to TruStage later. Whether to allow late or skipped payments for members awaiting a claim decision is left to the credit union. Credit unions are told to release letters of guarantee on total-loss settlements without waiting for TruStage, and that neither they nor their members will be penalized for doing so once the GAP claim is adjudicated. The 120-day window to qualify for the GAP PLUS benefit will be extended by the length of the outage; TruStage's own example is that a 60-day inability to pay Plus claims would extend the filing window to 180 days.
One change is a subtraction credit unions should notice. The description of the July 29 continuity process for recurring Debt Protection benefit payments has been replaced. Gone are the statements that payments are issued as a single lump sum reflecting the prior month's recurring payments, that the lump sum carries no member-level ledger so the claims team will contact participating credit unions with the detail, and that TruStage was starting the process for credit unions that received six or more recurring member benefit payments in the previous month. The replacement says payments are being prioritized for credit unions with the highest volume of approved recurring benefits and will continue to expand as recovery progresses, and directs credit unions with questions about a specific member to the claims team. The threshold that told a credit union whether it was in scope is no longer published.
Four other answers are new. A credit union may remove its Protection Advisor Expert connectivity credentials so it can test connectivity before all its lenders return; if it does, PAX will run as a standalone version when it comes back, and restoring connectivity would have to be set up again with TruStage and the systems provider. Business Protection policy servicing requests, including certificates of insurance and updates to vehicles or locations, now go to BusinessProtection@trustage.com. The Required Renewal Questionnaire is unavailable, with additional time to be given once system functionality returns and credit unions to be notified when it is back. On marketing, TruStage says its August direct mail is limited to auto insurance offers, that some members may still receive life offers that were already in progress before the attack, and that its licensed AD&D and life insurance call center agents remain available to help those members complete a direct mail application. That last line is about sales support for direct mail, not the life servicing contact center, whose reopening TruStage has still not confirmed anywhere in the tracked record.
What did not change is worth stating. The two payment options under the temporary GAP claim payment process that began August 12 are still unnamed. The lending claims instruction was only tightened in wording, telling credit unions to submit new claims through the approved claim-start process at trustage.com/startclaim. And the page remains undated, so the next edit will be just as silent as this one.
From August 19 to October 15 the page credit unions are told to work from said TruStage had started paying claims — preplanning and funeral, GAP, and debt protection and credit insurance — and that Life and AD&D claims pending at the outage are worked first. It deleted both on October 15.
Removed October 15. TruStage deleted the claims-paid list and the life and AD&D ordering from the credit union page that morning (see the October 15 item). What follows is the record of what the page said from August 19.
Between the 10 a.m. and noon sweeps on August 19, TruStage rewrote the claims answer on its credit-union outage page — the second content change to that page in one day, after the larger rewrite caught between the 8 and 10 a.m. sweeps. The answer previously described restoring systems and processes in a controlled and secure manner and left claim payment as something that would happen later. It now says claims remain a top priority and that TruStage has started paying claims across its business, naming preplanning and funeral claims, GAP claims, and debt protection and credit insurance benefits. A new paragraph says core Life and AD&D processing capabilities are being restored, that claims pending at the time of the outage come before claims received afterward, and that working through the backlog will take time. The GAP paragraph shifted from future to past tense: the temporary process began August 12.
None of that is new information. Every element matches TruStage's August 13 newsroom release, which this tracker already carries. What changed today is where it appears. Until this morning, the page TruStage directs credit unions to work from did not say that any claims were being paid at all — so a credit union following that instruction had no way to learn from the page that GAP or debt protection claim payments had resumed in any form.
The limits are unchanged and still on the page. TruStage says it has no product-specific claim payment timelines, that some servicing and claims-related activities remain limited, and that the temporary GAP process covers only open and pending claims established before the attack — claims filed since, through the interim intake form, are still excluded. The page carries no last-updated stamp of any kind, so nothing on it signals that an edit happened; this tracker caught it by diffing snapshots.
TruStage's consumer FAQ now names Payment Guard Advantage among the coverages whose grace periods it will extend once payment processing resumes — the first time that lending product has appeared in the promise. Two answers on the same page give different lists.
TruStage rewrote its consumer service-disruption FAQ between the 10 a.m. and noon sweeps on August 19. One answer contains something that has not appeared anywhere in this tracker's snapshot record before: the coverages whose grace periods will be extended once payment processing resumes now include Payment Guard Advantage, alongside Life, AD&D and Preneed. Payment Guard is a lending product sold through credit unions, so for the first time the grace-period commitment reaches borrowers and not only insurance policyholders.
The same page gives two different lists. The answer on whether coverage will lapse says grace periods will be extended for Life, Accidental Death and Dismemberment, and Preplanning Insurance — the wording TruStage put on its preplanning page on August 18. The answer on what to do once payment processing resumes says Life, AD&D, Preneed and Payment Guard Advantage. Preneed and Preplanning are the same line; Payment Guard Advantage appears in only one of the two answers. TruStage has not said which list is complete, and nothing on the page indicates whether the shorter one is simply older text left in place. A credit union asking on a borrower's behalf should treat the scope as unsettled rather than assume the longer list governs.
The rest of the rewrite is catch-up. A new question on when a claim will be processed or paid carries the August 13 release's claims language — payments started across preplanning and funeral, GAP, and debt protection and credit insurance, with Life and AD&D processing still being restored and pre-outage claims worked first. The retirement answers now say online account access is limited for plan participants, that balances and plan benefits are unaffected, and that some participants may request withdrawals and loans by phone if their plan allows and get balance updates the same way. The data-investigation answer picks up the paragraph about a comprehensive forensic and data-impact analysis run with outside cybersecurity experts, which has been on the individual and annuity outage pages since August 18.
A dating note: the page's own status block still reads August 18 at 11:15 a.m. CT. Its content changed today and the stamp did not follow — a pattern this tracker has now recorded several times across the TruStage outage family, and the reason the routine diffs page bodies rather than trusting timestamps.
TruStage has now dropped the mid-August target from its business outage page, replacing it with the same undated, phased-recovery wording used elsewhere. As of this August 19 check, Wealth Management Solutions is the last outage page still promising most key processes by mid-August; TruStage removed it from that page too on August 27. Six dated pages were restamped to August 19 at 9:17 a.m. CT.
TruStage restamped six of its dated outage pages to August 19 at 9:17 a.m. CT — the first movement since August 18 at 10:08 a.m. CT — and rewrote one of them. The business page at trustage.com/outage/business is the one that changed; the other five carry only the new timestamp and are otherwise word-for-word identical. All six still read Investigating.
The change is the removal already made elsewhere. The answer to when this will be resolved no longer anticipates that the majority of key processes will be operational by mid-August. It now describes bringing systems and applications back online through a deliberate, phased recovery and continuing to make progress, with no date attached. TruStage made the same edit to its consumer page on the morning of August 18, its retirement page that afternoon, and its credit-union page on the morning of August 19. With the business page, four of the five outage pages that carried the target have dropped it.
One holdout remains. The wealth-management page still carries the mid-August sentence word for word. The credit-union page also still contains the phrase, but only inside the transcript of the CEO video recorded earlier in the incident — a fixed recording, not current guidance — and TruStage's August 13 and August 14 newsroom releases carry it as dated historical statements. So the target has not been formally withdrawn anywhere; it is being edited out page by page, and one live page still states it.
The business page also picks up the data paragraph that reached the individual and annuity pages on August 18: TruStage says it is running a comprehensive forensic and data-impact analysis with outside cybersecurity experts, that the complexity of that work means it may take time to determine what information, if any, was affected, and that it will communicate through appropriate channels if notifications turn out to be required.
Annuity contract owners can now update their direct deposit instructions with a TruStage form, by e-signature or on paper. Two outage FAQs were removed in the same edit, but the death claim, withdrawal, surrender and cancellation forms behind them are all still on the page.
TruStage added a direct deposit form to the owner resources on its annuity outage page on the evening of August 19, again without moving that page's “Last Updated” stamp of 9:17 a.m. CT. Contract owners can now change where their annuity payments are sent, either by signing electronically through TruStage's forms partner in single-owner or joint-owner versions, or by downloading a printable form. Two resource headings were relabeled in the same edit: allocation changes and transfers are now grouped together, as are systematic withdrawals and required minimum distributions.
Two questions came off the page's outage FAQ at the same time, one on filing a death claim during the outage and one on how to withdraw funds or cancel an annuity. Neither capability was withdrawn. The page still links out to start a new death claim, and the partial withdrawal, surrender, application cancellation and right-to-examine forms all remain in the owner resources section above. The effect is to route contract owners to the forms rather than to an FAQ answer, which is worth knowing if your staff were pointing members at those questions.
The red alert banner across TruStage.com no longer says its systems are down and under investigation; it now says restoration continues and significant progress has been made, while “some services remain unavailable.” This is a wording change only — no service was named as restored.
Between 4:00 and 6:00 p.m. Eastern on August 18, TruStage replaced the standing red alert banner that sits at the top of its public pages. The previous line, in place unchanged in this tracker's snapshot record since it began on July 20, told visitors the company's systems were down while it investigated a recent cybersecurity attack and that teams were working on a resolution and activating business resiliency plans. The replacement says the organization continues to restore systems following the attack, that significant progress has been made, and that some services remain unavailable while it works to restore operations safely and securely.
The change appeared simultaneously on twelve TruStage pages in this run's sweep — the outage hub and all seven of its sub-pages, plus the three tracked newsroom releases and the newsroom index — which is what identifies it as a single site-wide template edit rather than an update to any one page. It was verified against the live site, not only against the snapshot: the outage hub returns the new wording and zero occurrences of the old.
What it does not do is change any service. No product was named as restored, no date was given, and the banner keeps an explicit statement that some services are still unavailable. The individual outage pages were otherwise byte-identical to the 4:00 p.m. sweep, and every “Last Updated” stamp on the outage family held at its earlier time — August 18, 10:08 a.m. CT on the six dated sub-pages and 11:15 a.m. CT on the consumer FAQ — so nothing on those pages moved with it.
It is still worth recording, because this banner is the first thing any member or credit union sees on TruStage.com and it is the company's shortest public characterization of its own status. After 29 days of describing the situation as systems being down and under investigation, TruStage now describes it as a restoration in progress.
Retirement plan participants can now request distributions and loans for most 401(k), 403(b) and 457(b) plans by emailing TruStage's participant service center, and get account details by phone at 800-999-8786. The mid-August target is gone from this page too; online access is still down.
TruStage rewrote the participant section of its retirement outage page late on August 18, adding two answers that describe interim ways to get money and information out of a plan while systems are still offline. Participants in most defined contribution plans — TruStage names 401(k), 403(b), governmental 457(b) and tax-exempt 457(b) — are told to email participantservicecenter@benefitsforyou.com to request a distribution or a loan. Account details can be obtained by calling the Participant Service Center at 800-999-8786, and TruStage says scheduled annuity and periodic benefit payments are being processed as usual. The page repeats that account balances and plan benefits are unaffected.
The mid-August target came off this page in the same edit. The "When will this be resolved?" answer previously ended by anticipating that the majority of key processes would be operational by mid-August; it now describes a deliberate, phased recovery with no date attached. That makes the retirement page the second to drop the target in one day, after the consumer outage page did so this morning. Checked against this run's own snapshots, the target still stands on the business, credit-union and wealth-management outage pages, in the August 13 and August 14 newsroom releases, and in CrossState's resource page.
The data-investigation answer also picked up the language that first appeared on the consumer page this morning: a comprehensive forensic and data-impact analysis with outside experts, a caution that its complexity means it may take time, and a statement that TruStage will communicate through appropriate channels if it determines that notifications are required. That wording is now on three of its outage pages — consumer, annuity and retirement — having been on none of them before today.
One removal is worth noting alongside the additions. The page previously carried a "What services are unavailable?" answer stating that BenefitsForYou was offline and that contribution and investment election changes, investment trade requests and beneficiary election updates could not be accepted. That question and answer are gone, and the phrase no longer appears on any TruStage page this tracker monitors. Nothing on the page says those functions have returned, and the BenefitsForYou portal still redirects to this outage page, so the disclosure was withdrawn rather than superseded. As with the annuity edit earlier today, TruStage made these changes without moving the page's "Last Updated" stamp, which still reads August 18 at 10:08 a.m. CT.
TruStage now names which coverages get extended grace periods once payment processing resumes — Life, Accidental Death and Dismemberment, and Preplanning. It has not yet decided how premiums missed during the outage will be handled, and says it will contact affected customers directly.
TruStage rewrote its funeral preplanning outage page this evening, between the 6 p.m. and 8 p.m. sweeps. Until tonight the page promised to extend “applicable grace periods” once payment processing resumed without saying whose. It now says TruStage will extend grace periods for Life, Accidental Death and Dismemberment, and Preplanning Insurance. That is the first time in the tracked record — across more than 1,450 page snapshots since July 20 — that TruStage has attached product names to the grace-period promise.
The more consequential half is a new limit. A rewritten answer says TruStage “continues to evaluate” how premium payments missed during the disruption will be handled, and that it will communicate directly with affected customers about any action required. So the two halves point in different directions: the extension of the grace period is now confirmed and scoped, while the treatment of payments that were skipped during the outage is explicitly still open. A member whose July premium never drafted has a coverage assurance but no answer yet on what they will owe or when.
Most of the rest of the rewrite is content this tracker already logged this afternoon from the consumer page, now propagated to preplanning: the four billing-restoration answers, including that recurring ACH billing has resumed for certain Life, AD&D and Preplanning customers, and that billing restoration does not mean systems are back online. The forensic and data-impact paragraph, with its first mention of possible notifications, has now reached this page as well. The claims answer was reworded to say claims will be processed as operational capabilities are restored.
Dating and verification notes. The page still reads “Investigating,” and its “Last Updated” stamp still says August 18 at 10:08 a.m. CT — unmoved despite a substantial rewrite, the fifth time today a tracked page changed without its stamp moving. The Mandiant investigation memo has not been withdrawn: the spelled-out URL disappeared from the visible text only because the reference became a hyperlink, and the link is still on the page. Nothing in this rewrite says the outage is over, and the mid-August target still stands on six other tracked pages.
TruStage's consumer FAQ no longer names mid-August; it now describes an undated, phased recovery. The target still stands on the credit-union and other business pages. Billing is what moved forward — recurring ACH billing has resumed for certain life, AD&D and preplanning customers.
TruStage restamped six of its dated outage pages to August 18 at 10:08 a.m. CT this morning — the first movement since August 17 at 9:32 a.m. CT — and rewrote one of them substantially. Five carry only the new timestamp and are otherwise word-for-word identical; the consumer page at trustage.com/outage/individual is the one that changed. All six still read "Investigating."
The most consequential edit is a removal. Until this morning that page answered "When will this be resolved?" by saying TruStage anticipated the majority of its key processes would be operational by mid-August. That sentence is gone. The answer now describes bringing systems and applications back through a deliberate, phased recovery and continuing to make progress, and it attaches no date at all. Today is August 18, so the target it replaced has passed. The mid-August goal has not been withdrawn everywhere — it still appears on the credit-union, business, retirement and wealth-management outage pages and in TruStage's August 14 recovery-progress release — so this is a change to the page members read, not yet a company-wide restatement. Whether the partner-facing pages follow is worth watching.
Billing is where the page moved forward rather than back. Four answers are new. TruStage says recurring ACH billing activity has resumed for certain life, AD&D and preplanning customers as part of its phased recovery, the first time preplanning has been named in that group. It explains why a customer may see an August premium drafted when a July premium was not — recurring payments are restarting from information already on file — and repeats that representatives cannot see individual account information or confirm the status of a specific payment. It sets out why billing was prioritized: keeping coverage in force was the concern customers raised most. And it draws the limit explicitly, saying billing restoration is one step and does not mean systems are back online, while warning that customers may hit delays or processing exceptions as services return. Recurring credit card and one-time payments are still unavailable.
Two other answers were expanded. On retirement accounts, the page now says online access remains limited for plan participants, that balances and plan benefits are unaffected, and that some participants may be able to request withdrawals and loans by phone where their plan permits, along with balance updates — detail TruStage had put in its August 13 release and partner materials but had not carried on the consumer page until now. On the data question, TruStage still declines to draw conclusions, but adds that it is running a forensic and data-impact analysis with outside cybersecurity experts, that the complexity means the work may take time, and that it will communicate through the appropriate channels if it determines notifications are required. That is the first time any tracked TruStage page has raised the prospect of notifications. It still attaches no interval; the two-to-three-month estimate reported in mid-August remains a partner and trade-press figure rather than something on this page.
What did not change matters for credit unions. The claims answer was only softened in wording, to say claims will be processed and paid as operational capabilities are restored. The credit-union outage page is unchanged for a twenty-fifth consecutive sweep, remains undated, and still carries both the mid-August target and the two still-unnamed GAP payment options. The consumer FAQ and outage-information pages are also unmoved, still stamped August 17. The practical effect for frontline staff: a member who asks TruStage's own consumer page when this will be over now gets no date in reply.
TruStage's annuity contact center is open weekdays 8 a.m. to 5 p.m. CT at 855-591-9027 — the first reopening TruStage itself confirms. Note the number changed on August 18: an earlier 855-798-5500 was replaced within hours. It also says all outstanding monthly annuity systematic withdrawals have been processed.
TruStage rewrote its annuity outage page this afternoon, adding a section headed "We're here for you" that says the Annuity Contact Center "is now open" Monday through Friday, 8 a.m. to 5 p.m. CT, and gives the number 855-591-9027. Representatives can confirm the status of withdrawals and surrenders, provide contract values, and help with the forms published on the page. They will discuss account-specific information only with the contract owner and the representative of record, and TruStage warns that call times may run long.
The page also reports movement on payments. TruStage says all outstanding monthly annuity systematic withdrawals have been processed, and that monthly withdrawals will now be processed on their scheduled payment dates. For ZoneChoice Advantage, ZoneChoice Income, ZoneChoice contracts issued on or after June 10, 2023, and most SPIA and annuitized contracts, existing quarterly, semi-annual and annual systematic withdrawals are being processed on schedule as well. TruStage is candid that most other non-monthly arrangements were not identified through its interim processing and that it is still working to find them, and it asks contract owners who missed an expected payment to call. Three new downloadable forms appeared alongside this — a beneficiary change form, a required minimum distribution form, and a systematic withdrawal form.
This matters beyond annuities because it is the first time TruStage's own pages have confirmed a call center reopening in the past tense. Trade press reported on August 12 that the life and annuity call centers were set to open Friday, August 14, and that claim sat unconfirmed for four days and fourteen tracker runs. The annuity half is now confirmed by TruStage directly. The life side is not: no TruStage page yet says a life contact center has reopened, and the consumer outage page still says representatives cannot access policy or account information or process transactions.
Two notes on how this arrived. TruStage made the edit without moving the page's "Last Updated" stamp, which still reads August 18 at 10:08 a.m. CT — the same stamp the page carried two hours earlier with none of this content, so the timestamp understates the change. Separately, the annuity page's data-investigation answer now carries the same language that appeared on the consumer page this morning: a comprehensive forensic and data-impact analysis with outside experts, a caution that complexity means it may take time, and a statement that TruStage will communicate through appropriate channels if it determines notifications are required. That language is now on two of its outage pages.
Correction, recorded August 18 at 4:01 p.m. CT: TruStage changed this number within two hours of publishing it. The page carried 855-798-5500 when the reopening first appeared and now carries 855-591-9027, with a matching dial link; the older number no longer appears anywhere on TruStage's outage pages. This tracker published the earlier number at 2:07 p.m. and has corrected it here and throughout the page. Credit unions that copied the first number into their own materials should replace it.
Retirement-plan trade press picked up the incident on August 17, restating TruStage's contained-environment and unaffected-assets positions and reporting that most defined contribution participants can transact by phone. It still carries the mid-August target TruStage has since removed from most of its outage pages.
The news site of the National Association of Plan Advisors covered the incident on August 17, the first retirement-industry trade coverage this tracker has logged. It reports that TruStage describes its operating environment as clean and contained on Mandiant's assessment, with no active intrusion, and that recovery continues across a network TruStage has had to rebuild in part. It repeats TruStage's position that annuity and retirement plan assets were not affected, and says most defined contribution participants, excluding certain legacy platforms, can request withdrawals, loans and account balance updates by phone.
The piece is largely a relay of TruStage's own statements. Its independent content is a quote of TruStage's chief executive on the likely cause, drawn from earlier CU Today reporting, and practical suggestions from an outside retirement consultancy for plan sponsors waiting on the recovery. One timing caveat for reviewers: it carries the mid-August operational target that TruStage has since edited out of the FAQ answers on all of its outage pages.
TruStage states publicly that it has built a clean technology environment separate from every impacted system, and that partners can safely use its communications and the links it sends through established channels. The rest restates the August 12 partner update.
TruStage published this release in its newsroom under the headline "TruStage confirms clean, isolated technology environment," dated August 13. It is the public counterpart to the August 12 partner email already recorded here — the entry for that email had to link the credit-union outage hub instead, because none of its content had reached a public TruStage page. It now has, at a citable URL.
One element is worth separating from the restatement. TruStage says the clean environment is segmented from systems that were impacted, potentially impacted, or still under investigation, calls it the foundation of the remaining restoration work, and draws a practical conclusion from it: partners may safely use TruStage communications, including the links it provides through its established channels, while systems come back in phases. For a credit union weighing whether a message that appears to come from TruStage can be trusted, that is the first authenticity statement the company has made in its own newsroom.
The balance repeats what this tracker already carries: a mid-August target for basic servicing across most businesses including reopened contact centers; the retirement call center open; claims being paid across preplanning and funeral, GAP, and debt protection and credit insurance, with life and AD&D processing still being restored and pre-outage claims worked before newer submissions; annuity and retirement plan assets unaffected; billing resumed to avoid coverage disruption; and roughly two to three months before the data investigation produces answers.
Two dating notes. The release says the life and annuity call centers "will open by end of week" — future tense, written the day before the reported August 14 date — so it does not confirm that the reopening happened, and no source yet does. And it surfaced four days after publication: TruStage's newsroom index builds its article list in the browser and returns no article links to either a plain fetch or a rendering one, so a new release is not discoverable from any page this routine tracks. This URL has now been added to the snapshot sweep.
A temporary process to resume GAP claim payments began August 12 — but only for claims established before the attack. Claims filed since, through the interim intake form, are not part of the process yet.
TruStage rewrote the claims and payments answers on its credit-union outage page (snapshots place the change between 4:01 and 7:04 p.m. ET), and one part has not appeared on any TruStage page before: a temporary process to resume GAP claim payments began Wednesday, August 12, covering open and pending claims established before the attack, with two payment options to be available. The page does not say what the two options are — expect to be told separately.
The limit matters as much as the restart: claims submitted after the attack through the claim intake form are not part of this process at this time. A credit union that filed through the interim intake route since mid-July should not read this as covering those claims. Otherwise the page repeats its position — representatives can take inquiries, some servicing and claims activity remains limited, and no product-specific claim payment timelines are available.
The same rewrite finally carries TruStage's August 12 billing detail onto the partner-facing page, closing a gap flagged yesterday: the August 4 ACH restart for certain life and AD&D policies, the late-July and August due dates being worked through, recurring card and one-time payments still unavailable, and card billing expected before direct bill. It mirrors the honored-by-date-received guidance for outage-period cancellations and changes, and routes life and AD&D changes to the mail-in forms page.
Two things did not move: the page remains undated, and it says nothing about the life and annuity call centers reported as due to open Friday, August 14.
Trade press: TruStage says it remains on track for mid-August and claim payments have begun across business lines — and, for the first time with an interval attached, says the data question will likely take two to three months to answer.
Credit Union Daily reported a new TruStage recovery update in which president and CEO Terrance Williams said the company is making 'steady advancements in restoring our technology environment' and remains on track for most key processes by mid-August. Per the report: the retirement contact center has reopened and the life and annuity centers are due August 14; claim payments have begun moving across business lines, with the pre-outage backlog of life and accidental death claims prioritized; billing has resumed so coverage is not disrupted; and defined contribution participants may request withdrawals and loans by phone. Retirement and annuity account values remain unaffected.
On data, Williams reportedly said it will likely be two to three months before the company can say whether member or employee information was involved — the first time any interval has been attached to that answer.
The statement is undated and appears on no TruStage public page as of capture; TruStage's own pages were unchanged this morning, so this is recorded as reported rather than confirmed. TruStage's own August 12 email update to partners, received by the association on August 14, has since confirmed the account firsthand — see the entry logged for that update.
The association has now received TruStage's August 12 partner update directly, converting this week's trade-press picture — call centers reopening, claim payments restarting, a two-to-three-month data timeline — into first-party confirmation. New in it: preplanning and funeral claims are being paid, and most defined-contribution participants can request account-balance updates by phone.
TruStage's August 12 email update to partners, signed by president and CEO Terrance Williams, reached the association directly on the morning of August 14. It confirms firsthand what this tracker had carried only through trade-press and peer-association relays: basic servicing targeted for mid-August, the retirement call center open with the life and annuity contact centers opening Friday, August 14, billing resumed so coverage is not disrupted, and Mandiant's confirmation of the clean, isolated environment built apart from impacted systems.
Two details had not appeared in any relay. Claims are being paid across the business including preplanning and funeral claims — alongside the GAP and debt-protection restarts already tracked — with life and AD&D processing still working pre-outage pending claims before newer submissions. And the majority of defined-contribution participants, other than those on certain legacy platforms, can request withdrawals and loans where their plan allows and ask for account-balance updates over the phone.
On data, the update repeats the two-to-three-month estimate for complete answers and the commitment to notify affected parties first if member or employee data is compromised.
Because this is a communication addressed to partners rather than a public page, this entry links TruStage's public credit-union outage hub instead of the email. None of this content appeared on TruStage's public pages as of this morning's sweep.
Trade press: life and annuity contact centers were due back August 14, and TruStage expects the forensic review to need another two to three months before it can say whether member data was involved — naming Epiq Global on data analysis alongside Mandiant.
CU Today reported that TruStage, in its latest update to credit union partners, said it remains on course for most key processes running by mid-August, with basic servicing available across most businesses. The retirement contact line is already taking calls; the life and annuity lines were set to reopen Friday, August 14 — with warnings to expect heavier volumes, longer handling times, and limits on what representatives can do at first.
On data: TruStage expects the forensic review will likely need another two to three months before it can say whether credit union member or employee information was involved. The report names Epiq Global as the firm handling data analysis alongside Mandiant on forensics, and relays Mandiant's finding of 'no indication of an active intrusion' since the July 11 detection — consistent with the memo TruStage published August 10. Whether any data was actually accessed or taken remains undetermined.
This update appears on no TruStage public outage page as of capture, so it is recorded as reported rather than confirmed.
TruStage dates the ACH restart to August 4 for certain life and AD&D policies and says late-July and August due dates are being worked through, with card billing expected back before direct bill. Changes and cancellations requested during the outage will be honored by date received.
TruStage re-stamped its dated outage pages on the afternoon of August 12 and used the individual page to put detail behind its billing position. The payment answer now carries a start date: recurring ACH premium collection began coming back on August 4 for certain life and AD&D policies, and TruStage is working through policies whose due dates fall in late July and August. Recurring credit card and one-time payments remain unavailable; TruStage expects card billing to return ahead of direct bill, which will take additional time.
That partially answers the eligibility question flagged as unanswerable on August 11 — it describes a scope, though still no way for a member or credit union to confirm whether a particular policy sits inside it.
Two new answers concern servicing: requests to change or cancel a policy submitted while systems were down may not yet be reflected in billing; TruStage will process them as capability returns and honor each by the date received. Life and AD&D changes are routed to the mail-in service forms page, itself reorganized the same evening.
Quieter changes worth flagging: the individual page shortened weekday outage-line hours from 5:30 to 5:00 p.m. CT (Saturday unchanged), and the credit-union page picked up none of the new billing language — staff should read the individual page directly. Status still reads Investigating.
TruStage reopened dedicated retirement phone lines — 844-999-2677 for plan sponsors, advisors, and TPAs; 800-999-8786 for participants — and says representatives now have limited account access. A staffing improvement, not a systems restoration: BenefitsForYou is still offline.
TruStage improved the contact and servicing posture on its Retirement Solutions page. Where it previously said representatives could not access account information or process transactions, it now says they have limited access to account information and limited transaction capabilities. Two dedicated lines replace the general outage number: a Retirement Service Center at 844-999-2677 for plan sponsors, advisors, and third-party administrators, and a Participant Service Center at 800-999-8786 for participants — weekdays 8:00 a.m.-5:00 p.m. CT. Neither number had appeared on any TruStage outage page previously captured.
Two cautions for credit unions passing this along. This is a change in what staffed phone lines can do, not a systems restoration: BenefitsForYou is still offline, contribution and investment election changes, trades, and beneficiary updates still cannot be accepted, and status still reads Investigating. The new lines also carry narrower hours than the general line they replace, which ran to 5:30 p.m. weekdays and covered Saturdays.
TruStage did not advance the page's timestamp for this change, and the later August 11 family re-stamp accompanied a separate change — so the date recorded is the date this tracker verified the new language.
TruStage's status page now calls the event a cybersecurity attack and replaces its technical FAQs with a new Investigation FAQs document for vendors and partners — the consolidated channel for the vendor-management questions credit unions will be asked.
TruStage rewrote its outage-information status page. The heading now describes an actively investigated cybersecurity attack (previously incident), and the body matches the July 31 press release: the attack was broad, portions of the network and systems are being rebuilt rather than switched back on, and services restore in a deliberate sequence protecting employees, partners, members, and customers.
The closing pointer changed too: the Technical Incident FAQs reference that stood since July has been replaced by a new Investigation FAQs document dated August 10, described as answering vendors' and partners' questions about what happened, what steps TruStage has taken, what is known, and what remains under investigation. The link opens TruStage's document viewer displaying the four-page PDF rather than downloading a file.
Operationally nothing changes — status still reads Investigating and the mid-August target is unchanged — but the new document is TruStage's consolidated channel for the vendor-management questions credit unions are expected to ask their vendors after an event like this. It is linked under Resources below.
For the first time, TruStage's containment claim is sourced to its forensic firm: a new FAQ points to a public Mandiant memo saying the incident is contained and systems return to a clean environment. It is not a data-exposure finding, and Mandiant confines its findings to the scope of its investigation.
TruStage added the same new question to five of its outage pages and a matching line to the hub — the most substantive change in a week. The question: has a cybersecurity expert provided information on whether the incident is contained and whether TruStage is operating in a clean, safe environment as systems return? TruStage answers yes, says it continues to work closely with Mandiant, and directs readers to a Mandiant investigation memo dated August 10, published at a public address on TruStage's own site. The memo was linked under Resources from August 11; that card now opens the most recent memo TruStage links.
Why this matters: TruStage has said since July 31 that the incident was contained, but that was TruStage speaking about itself. This is the first time the outside forensic firm's assessment is public under Mandiant's name — the first time the containment claim is sourced to something a reader can inspect.
On the question credit unions ask most, Mandiant writes that it has not observed the threat actor interacting with files shared with third parties, or with third-party systems, portals, VPNs, APIs, or other environments connected to TruStage. Read that with the limit Mandiant places on it: the preceding sentence confines its findings to the environments within its investigation's scope, and the memo does not define that scope. It is not an unqualified all-clear for every connected credit union system, and it says nothing about whether data was accessed — which TruStage still calls premature to judge. It does not replace your own review of any connection you maintain to TruStage.
It is also not a restoration announcement: every page still shows status Investigating and the mid-August target is unchanged. The five pages carrying the question are credit union, business, annuity, preneed, and retirement; individual and wealth management had not picked it up at capture. TruStage re-stamped the outage family August 11 at 12:13 p.m. CT alongside this change.
The first payment processing actually restarts: recurring ACH premium payments are resuming for some eligible customers using details on file. Credit card and one-time payments remain down, and there is no way to check whether a particular policy is in scope.
TruStage rewrote the payment section of its individual and credit-union outage pages late on August 11 (snapshots place the change between 4:25 and 6:12 p.m. CT). Recurring ACH premium payments are beginning to resume for some eligible customers, drawing on payment information already on file. Recurring credit card payments and one-time payments are still unavailable, and because account access remains limited, representatives cannot verify an individual customer's payment activity or policy status.
This is the first time TruStage has said any premium payment processing is actually restarting rather than promised for when systems return — a concrete restoration step. Read the scope carefully before passing it to members: one payment method, only 'some eligible customers' in TruStage's words, and no way for a member or credit union to find out whether a particular policy is in that group.
The individual page also restructured its coverage answer — customers will not lose coverage because they were unable to pay during the disruption; active and grace-period policies keep their status until normal processing resumes, with accommodations including extended grace periods to follow. The warning that TruStage is not sending premium-payment requests or past-due notices carries over and has been added to the credit-union page, so staff fielding a call about a suspicious notice can point to the page written for them.
Neither page advanced a date stamp for this change, and status across the outage family still reads Investigating.
Trade press: AM Best said on August 7 that its credit ratings for TruStage Financial Group, Inc. and Union Security Insurance Company remain unchanged, and that the disruption has not materially affected the enterprise's credit profile. The agency said it will keep monitoring.
The insurance ratings agency AM Best published a comment on August 7 at 11:21 a.m. Eastern saying its credit ratings for TruStage Financial Group, Inc. and Union Security Insurance Company remain unchanged following TruStage's disclosure of the July 11 cybersecurity incident. AM Best said the disruption “has not had a material impact on the credit profile” of the enterprise, and that it believes TruStage is taking the necessary actions to address the attack.
What the comment rests on matters. AM Best attributes its view to its own interactions with TruStage's executive management, and it repeats management's position that the threat was contained rather than reaching that conclusion itself. In the same comment it records that the attack critically affected TruStage's technology infrastructure and that some operations remained shut down as of that date. So this is a judgment about financial strength and credit profile, not an independent finding about the incident's technical scope or about member data.
AM Best also said it will keep watching for signs that the incident has damaged TruStage's ability to conduct business, harmed its reputation, or would change the agency's view of TruStage's enterprise risk management, which it described as appropriate at the time of writing. That is a stated condition on the comment, not a prediction.
Two dating points for credit unions reading this. The comment is nearly four weeks old and predates TruStage's August 13 release on a clean, isolated environment, so it does not take that release into account. It also appears on none of the twenty-five TruStage or partner pages this tracker sweeps; it was found through a search on September 2 and read on AM Best's own news service rather than through a wire redistribution.
Advisors and credit unions can now reach Salesforce by direct login, per the Wealth Management page — though the page's own line that advisors cannot access client notes still stands unreconciled, so confirm the scope with your TruStage contact.
TruStage rewrote its Wealth Management Solutions outage page and answered a question it had deferred since the outage began: advisors and credit unions can get into Salesforce through a direct login, with instructions from their assigned Advisor Manager Specialist or Regional Program Consultant.
One caution for program staff: the page's own 'What you should know' paragraph still says advisors cannot access Salesforce for client-specific notes — the old and new statements sit unreconciled on the same page. Treat the direct-login route as the newer of the two and confirm its scope with your TruStage contact.
The page also adds a compensation answer for the second half of July — managed and dual advisors paid on the regular schedule, credit unions paid the same amount as the first half, which was based on a six-pay-period average — and finally adopts the mid-August recovery answer and standard recovery lead, making it the last outage sub-page to catch up.
TruStage is on record that it is not behind any offer to replace, surrender, or discontinue in-force coverage. Useful for members being pressed to switch policies during the outage — the offer is not coming from TruStage.
A new question on TruStage's individual outage page addresses policyholders who have been approached about replacing their insurance with another company's. TruStage answers plainly: such offers do not come from the company, and it is not encouraging, facilitating, or taking part in any effort to replace, surrender, or discontinue in-force coverage — because of the incident or as part of recovery.
Worth passing to members: an insurer's systems being offline is exactly the circumstance in which policyholders may be told their coverage is at risk and pressed to switch. TruStage is now on record that it is not the source of those approaches.
TruStage did not advance the page's timestamp (still August 6), so the date recorded is the date this tracker verified the answer was publicly visible.
Auto and home insurance is running normally through Liberty Mutual and Polly — quotes, purchases, servicing, and claims all uninterrupted — the first product line TruStage describes as fully working.
TruStage added a product question to its credit-union outage page confirming that auto and home insurance is operating through its partnership with Liberty Mutual and Polly: members can get quotes, buy coverage, have policies serviced, and reach claims support, none of it interrupted by the attack. One caveat: while the servicing experience 'remains largely unchanged,' the online experience may look different for now.
This is broader than what was previously on the record — the July 23 video had Liberty Mutual and Polly processing new business from direct-mail leads; TruStage now describes the full policy lifecycle, servicing and claims included, as running without disruption. For staff fielding member questions, it is one of the few product lines that can be discussed as working normally.
The credit-union page carries no date stamp, so the date recorded is the date this tracker verified the answer was publicly visible.
TruStage now promises interim retirement processes and commits to statement dates: paper quarterly statements have mailed, and participants who elected e-statements will be sent paper copies expected the week of August 10.
TruStage substantially rewrote its Retirement Solutions outage page under an August 6 timestamp. It now says it will introduce temporary processes while recovery continues and is contacting plan sponsors as solutions become available. On payroll, where the page previously said flatly that non-aggregator files could not be processed, TruStage now says it is working on an interim solution and will share news with sponsors.
Statements moved from open-ended delay to specific commitments: quarterly paper statements for the period ended June 30 have been mailed, and participants who elected electronic statements will be sent a paper copy, expected to mail the week of August 10 — some who signed up for paper may receive a duplicate.
Two items also quietly left the unavailable list: the sentence about the Participant Service Center phone and email being down, and loan and distribution requests among those TruStage cannot accept. TruStage did not describe either removal as a restoration, and this tracker does not treat it as one.
Two more annuity self-service routes: an e-signed direct-deposit change form and a downloadable income-benefit form for Zone and ZoneChoice Income contracts. These are workarounds, not restored processing.
TruStage extended the self-service annuity forms introduced August 4 with two further routes: an e-signed direct deposit change form through AssureSign, in single- and joint-owner versions, and a downloadable income benefit service form for Zone Income Annuity and ZoneChoice Income Annuity contracts. The general resources block was reorganized — transfer and allocation-change forms consolidated, the claims link moved alongside — and the advisor-resources block pointing producers to their wholesaler was removed.
As with the August 4 forms, these are workarounds rather than restored processing: online account access remains down, and TruStage has not said requests submitted this way will be handled faster than its recovery timetable allows.
Individual life and AD&D policyholders get their first servicing route of the outage: mail-in PDF forms for ownership, beneficiary, and service changes, honored back to the date each request was received.
A new page on TruStage's outage site gives individual life insurance and AD&D policyholders a way to submit servicing requests while systems are down — their first servicing route of the outage. It carries downloadable PDF forms for changes of ownership, beneficiary changes, and general service requests (billing-frequency changes, withdrawals, loans, cancellation or surrender), with versions depending on whether the policy is issued by CMFG Life or MEMBERS Life and the policy-number prefix. Ownership changes require a completed W-9.
Instructions: print, complete, sign, and mail to the address on the form — fax is not available. TruStage says requests will be processed as systems are restored and honored back to the date received.
It parallels the annuity forms route added August 4, though mail-based rather than e-signed. TruStage did not advance the individual page's timestamp when the forms appeared, so the company has not itself stated a publication date.
TruStage's outage-page lead no longer says the attack was contained. The claim still stands in the July 31 press release, but the lead copy now stresses the breadth of the impact and the rebuilding of infrastructure instead.
TruStage revised its outage-page lead again, re-stamping the dated pages August 5 at 4:48 p.m. CT. The sentence saying the incident had been contained since detection is gone from the lead; the new copy stresses the breadth of the impact across the network and systems and the deliberate rebuilding of infrastructure so services restore safely. On the outage hub, the paragraph stating the incident was contained and no malicious code or bad actor remained was removed altogether.
The containment statement has not been withdrawn — it still stands in the unchanged July 31 press release. It simply no longer appears in the outage-page lead copy.
Separately, the credit-union page joined the rewrite it had sat out for two days: it now calls the event an attack, adopts the same recovery language, adds the mid-August resolution answer, and sharpens its claims guidance to file new claims through the online intake page. That page is still undated, and status across the site still reads Investigating.
Credit unions whose members were already approved for recurring Debt Protection payments are being paid a single lump sum mirroring the prior month. TruStage's claims team will contact each participating credit union directly with the member-level detail.
TruStage's credit-union outage page now describes how recurring Debt Protection benefit payments are handled while systems are down: a temporary business-continuity process, begun July 29, for credit unions whose members were already approved for recurring payments. Rather than paying individually, TruStage pays a single lump sum generally mirroring what the member received the previous month, adjusted where a benefit has since ended.
Because the lump sum arrives without a member-level ledger, a member of TruStage's claims team will contact each participating credit union directly with the payment detail needed to get the money to the right members. The process starts proactively for credit unions that received six or more recurring member benefit payments the previous month; credit unions below that threshold may ask the claims team to review a member they believe should have been paid.
This is the first time the arrangement has appeared on TruStage's own public page; early-August trade press had described it only as a test with a small number of credit unions.
TruStage rewrote its public outage pages: the event is now a cybersecurity attack identified on July 11, described as contained, and the mid-August target now appears on the ordinary public pages members are sent to.
TruStage revised every dated public outage page and its consumer FAQ on the morning of August 4 — the first substantive rewrite of that language since the incident began. The event is now called a cybersecurity attack rather than an incident throughout, 'identified on July 11' — a date previously given mainly through partner materials and press releases. The opening paragraphs now say TruStage continues to make progress on recovery, that the attack has been contained since detection, and that it is rebuilding portions of its infrastructure and restoring systems in a controlled way.
Most significant for members: a new question on when this will be resolved now appears on the business, retirement, and other outage pages, answering with the mid-August target for the majority of key processes. That target had lived only in the July 31 press release, the CEO video, and emailed partner materials — it is now on the ordinary public pages members are sent to.
The status field still reads Investigating everywhere, and TruStage still calls it premature to draw conclusions about whether any data was accessed.
Annuity owners now have a forms-based way to transact: e-signed cancellation, right-to-examine, partial-withdrawal, and surrender forms through AssureSign, plus downloadable transfer forms. Online account access remains down.
Alongside the August 4 rewrite, TruStage expanded what annuity contract owners can actually do while systems are down. The annuity outage page now offers electronically signed forms through third-party partner AssureSign for cancelling a pending application, exercising the right to examine, taking a partial withdrawal, and surrendering a contract in full — each in single- and joint-owner versions. A general-resources block adds downloadable transfer and allocation-change forms for the ZoneChoice, Zone, Horizon, and Variable Annuity products, labelled as PDF downloads on TruStage's page. The consumer FAQ also gains a link to a new individual service hub covering claims, annuity resources, and retirement support.
The practical effect: annuity owners who previously had no route to transact now have a forms-based one. Processing still depends on TruStage's restoration — transactions will be handled by the date and time received — and online account access remains unavailable.
A new CEO video on the credit-union page carries the July 31 message — attack contained, Mandiant named, mid-August target. It replaces the July 23 video, whose cause-and-NCUA material now lives only in this tracker's earlier entry.
TruStage refreshed its dated outage pages on the afternoon of August 3 — the first stamp movement in three days — and the substantive change is on the credit-union page, where the July 23 CEO video has been replaced by a new one. In it, Terrance Williams describes the July 11 event as a broad attack on TruStage's network and systems, says the incident was contained and the company is confirming no malicious code or threat actor remains as it rebuilds, and repeats the mid-August target with the caveat that systems may return before fully normal. He notes refreshed workforce laptops and updated security, names Mandiant as the partner on the data investigation, tells credit unions TruStage still does not know whether member data was accessed — partners will be the first to know — and commits to email updates multiple times a week.
The content matches the July 31 newsroom release; what is new for credit unions is that it now sits on the page they are directed to. The July 23 video's material — including the malicious-file account and the NCUA reporting process — is no longer on the page; it remains recorded in this tracker's July 23 entry.
In its fullest public statement yet, TruStage says the incident is contained, names Mandiant as its forensic partner, and puts the mid-August target on the record — while saying it still does not know whether member data was accessed.
TruStage published a second incident press release in its newsroom, dated July 31 — the fullest public account it has given. The incident has been contained; the event was broad enough that TruStage rebuilt parts of its infrastructure so systems could be brought back safely rather than simply switched back on, and as it rebuilds it is confirming no malicious code or bad actor remains. Employee laptops have been refreshed and security measures updated, with that work close to complete.
On timing, TruStage states publicly for the first time that it anticipates the majority of its key processes will be operational by mid-August, prioritizing the operations most critical to partners and their members — cautioning that some systems may come back before they are fully operational, with workarounds continuing meanwhile.
On data, it names Mandiant as the outside cybersecurity partner on the investigation, says forensic work takes time, states it does not yet know whether member data was accessed, and commits that if members' personal information is involved it will tell affected partners first and help with any notification or reporting. It also commits to partner email updates multiple times a week.
For credit unions this matters on three counts: the mid-August target is now an on-the-record public statement, the forensic firm is named for the first time, and the containment statement is TruStage's own words.
TruStage published an optional member-letter template and a staff talking-points sheet, both dated July 31 — its first published documents to put the mid-August operational target in writing, with a careful definition of what that target means.
TruStage published two dated communications documents for credit union partners, both stamped July 31 and hosted on trustage.com: an optional member-and-customer letter template that credit unions may adapt and send, and a talking-points-and-FAQ sheet for staff. Neither carries a confidentiality marking. Their significance: they are the first TruStage-published documents to state a restoration target — 'working toward being operational by mid-August.'
The definition is careful: priority processes and services available through a mix of restored systems, interim processes, and alternative support paths — not every system immediately at full functionality, with temporary workarounds possibly remaining. Until now the target had appeared only in trade-press reporting of a CEO video, and it was still absent from TruStage's public outage pages.
On the recovery, TruStage says it stood up a clean, isolated technology environment segmented from impacted systems, validated by outside cybersecurity experts using secure recovery practices, with restored services passing established validation before production. It describes the event in its own words as a cybersecurity attack that significantly impacted critical technology infrastructure.
The materials summarize progress — claims reporting, expanded phone support including a third-party contact center, lending-related payment processes, certain annuity and retirement processes, recurring disbursements restored — note that platforms with more dependencies may take longer, repeat that conclusions on data are premature, and commit that TruStage will work directly with credit unions and partners if it determines data was compromised.
Trade press: the CEO told credit union partners most key processes should be operational by mid-August — the first restoration timeline attributed to TruStage, though it appeared on no public TruStage page at capture.
CU Today reported that TruStage president and CEO Terrance Williams gave credit union partners a new video update saying the company anticipates the majority of its key processes will be operational by mid-August, cautioning that systems coming back online may not be fully operational or fully back to normal. On data, he said the company does not yet know whether member data was accessed, and partners would be the first to know if that changes.
Per the report: customer calls are handled through a third-party contact center, lending capability is in testing with eight credit unions, annuity transactions, death claims, and withdrawals are moving again, and basic billing and claims servicing is expected in the first half of August. The life insurance platform is more complex, spanning several interconnected systems, and broader systems remain offline.
This was the first restoration timeline attributed to TruStage. At capture it appeared on no TruStage public page — the credit union outage page still said no product-specific claim timelines were available — so it is recorded as reported rather than confirmed.
TruStage still cannot say when claims will be paid: product-specific timelines are not available, and claims will be evaluated and paid under policy terms as capabilities return. Some servicing and claims activity remains limited.
TruStage substantially expanded the FAQ on its credit-union outage page, adding a general outage section and answers written for credit union leaders. The most decision-relevant point: TruStage still cannot say when claims will be paid. 'Product-specific claim payment timelines are not available,' and claims will be evaluated and paid under the applicable policy terms as operational capabilities are restored. Representatives can take inquiries and offer guidance, but some servicing and claims activity remains limited.
It restates: premature to draw conclusions on scope, impact, or data access; grace periods are being extended, with more than one premium possibly coming due; BenefitsForYou is still unavailable; annuity and retirement balances and benefits are unaffected.
New for credit unions planning ahead: the timing and approach for restarting marketing activity, including direct mail scheduled for August, is under evaluation, with lead-fulfillment plans to be communicated separately. The page's question-submission form was replaced with a pointer to the credit union's account representative. The page carries no date stamp of its own; the content appeared between midday and late afternoon on July 31.
The first Retirement Solutions processing resumes: payroll files submitted through third-party aggregators (PayKonnect, Payroll Integrations) and previously scheduled distributions are moving again. BenefitsForYou is still offline.
TruStage's Retirement Solutions outage page (re-stamped July 30, 4:43 p.m. CT) reverses two answers that previously read as unavailable: payroll files submitted in good order for 360 processing through third-party aggregators — the page names PayKonnect and Payroll Integrations — are now being processed, and previously scheduled installment and annuity distributions are being processed again. Other payroll submissions remain unavailable.
Plan sponsors are no longer told to withhold payroll files; the guidance now says to continue normal payroll operations, including withholding participant deferrals and loan repayments.
Two limits are newly stated: participants and employers who elected electronic benefit statements may see a delay for the quarter ended June 30, and sponsors whose custodian or directed trustee is Matrix Trust Company can log in through Matrix/Broadridge for plan-level statements — an option that does not apply to Choice Group Variable Annuity plans. BenefitsForYou is still offline and participant transactions remain unavailable.
TruStage will extend applicable grace periods once payment processing resumes — and states it is not currently sending premium-payment requests or past-due notices, so members receiving one should treat it as suspect and not click, share, or pay.
TruStage added two answers to its consumer FAQ and its individual and preplanning outage pages, first seen on the July 30 stamp. Because payment processing is unavailable, it will extend applicable grace periods once processing resumes — and depending on when premiums normally fall due, more than one payment may come due during the extended period. Policies that are active or in a grace period keep that status meanwhile.
Separately, TruStage states it is not currently sending communications requesting premium payments or telling customers a payment is delinquent, and tells anyone receiving such a message not to click links, provide personal information, or submit payment information. That gives credit unions a concrete answer for members who call about a past-due notice during the outage.
TruStage itself now publishes the credit-union interim processes: credit insurance, debt protection, and GAP can still be sold; eligible PAX credit unions may use the GAP workaround; GLOW produces MRC quotes but no contracts; and every outage-period sale must be documented for later PAX entry.
TruStage's outage hub now includes a page written for credit unions. Credit insurance, debt protection, and GAP can still be sold, and members are directed to start claims at trustage.com/startclaim.
The interim processes that earlier reached us through a state association are now stated by TruStage itself: eligible PAX credit unions may use the approved GAP workaround, must document every sale made during the outage, and must enter those sales into PAX once service is restored. A limited group of high-volume credit unions may use Assurant's GLOW platform to generate mechanical repair coverage quotes and member pricing and finance the cost into the loan — GLOW explicitly cannot issue contracts, so the official MRC certificate issues only after PAX is back and the sale entered. Selected credit unions receive separate implementation instructions.
For GAP claims and servicing — including a vehicle totaled before a contract could be completed in PAX — the instruction is to keep collecting claim details and supporting documentation. TruStage does not date this page, so the date shown is the date the IT Department captured it.
TruStage spells out the NCUA reporting path — 1-833-CYBERCU or cybercu@ncua.gov, referencing the TruStage event — and tells credit unions to consult their own legal, compliance, and risk teams on notification duties.
TruStage's Wealth Management Solutions outage page (stamped July 28) spells out the regulatory mechanics in TruStage's own words: the NCUA is aware of the event, and a credit union that determines the incident is reportable may satisfy that by calling 1-833-CYBERCU (1-833-292-3728) and leaving a voicemail, or emailing cybercu@ncua.gov, giving the credit union's name and referencing the TruStage cybersecurity event.
On whether a credit union must notify its regulators at all, TruStage does not advise: requirements depend on the credit union's own customer relationships, applicable law, and internal policy — consult legal, compliance, and risk teams.
Operationally, the program's financial advisors can serve members through their LPL access and can sell and service every product except TruStage annuities; advisors cannot reach Salesforce for client notes; and an online option is open for annuity partial withdrawals and surrenders, with processing slowed by manual handling. Advisor and credit-union compensation for the first half of July was paid on schedule using an estimate based on the average of the last six pay periods.
TruStage says individual coverage will not lapse: a policy that is active or in a grace period keeps that status until payment processing resumes. The outage line, 844-958-8910, was then staffed seven days a week; TruStage has since dropped Sunday hours.
TruStage's outage pages for individuals and preplanning coverage (stamped July 28) answer the question front-line staff are most likely to be asked: individual coverage status is not at risk during the outage. A policy that is active or in a grace period stays in that status until regular payment processing resumes, and policyholders can make or update payments once operations are restored.
If someone dies during the disruption, the claim will be processed and paid under the applicable policy terms once TruStage is able; claims start at trustage.com/startclaim. Representatives currently cannot see policy or account information, process transactions, or submit requests.
A dedicated outage line is published: 844-958-8910, weekdays 8:00 a.m.-5:30 p.m. CT and weekends 9:00 a.m.-4:00 p.m. CT, with a warning that waits are longer than usual. Those hours have since been cut twice, and this entry recorded the original pair: Sunday service was off the page by July 31, and the weekday close moved back to 5:00 p.m. CT by August 12. The number held until September 2, when TruStage replaced it on that page with 855-591-9026 and dropped the Saturday hours; see the September 2 entry. At the August 28 check the page publishes weekdays 8:00 a.m.-5:00 p.m. CT and Saturday 9:00 a.m.-4:00 p.m. CT — so a credit union that copied the weekend hours from this entry should correct them. On data, the answer is unchanged: conclusions about scope or impact remain premature.
TruStage says annuity contract values and retirement balances are unaffected, and it has found no evidence of unauthorized transactions on contract-owner funds. BenefitsForYou remains offline, and plan sponsors get record-keeping guidance for the delay.
TruStage's annuity and retirement outage pages (both stamped July 28, 10:43 a.m. CT) carry the most concrete reassurance the company has published so far. On annuities: contract values, account balances, and benefits have not been impacted; transactions will be processed by the date and time received once servicing resumes; and the investigation to date shows no evidence that contract-owner funds, the assets backing annuity obligations, or other company financial accounts saw unauthorized transactions. Owners can submit partial-withdrawal and surrender forms through the company's e-signature partner meanwhile.
On retirement plans: account balances and plan benefits are unaffected, but with BenefitsForYou offline participants cannot view balances, change contributions or investments, trade, update beneficiaries, or request loans and distributions, and the participant service center's phone and email are down. Plan sponsors are told not to submit payroll and contribution files — including through aggregators — but to continue normal payroll operations and withholding, to keep records of processing dates and outage communications, and that Department of Labor guidance allows additional time when the delay is the service provider's outage.
Previously scheduled installments and annuity distributions cannot be processed at present; quarterly statements for the quarter ended June 30 are mailing on the normal schedule. On data, both pages still call conclusions premature.
Trade press: TruStage's partner FAQ names forensic firm Mandiant, confirms law-enforcement, NCUA, and regulator notification, and reports no threat-actor activity since July 11 — but still no answer on whether credit union data was accessed.
Credit Union Daily reported that TruStage issued an updated technical FAQ for its business partners. Per the report, TruStage notified law enforcement, engaged the forensic firm Mandiant, made the NCUA aware of the event, and notified applicable regulators. It states it has seen no threat-actor activity since July 11, has identified no known CVEs tied to the compromise, and has not observed the attacker interacting with files shared through third-party systems, portals, VPNs, or APIs connected to TruStage.
It still will not say whether partner or credit union data was accessed or exfiltrated, when access began, how long the intruder remained, what type of attack occurred, or whether anyone claimed responsibility — and it cannot yet give an individual credit union a written attestation about its data. A credit union that determines the event is reportable may notify the NCUA by phone or email, referencing the TruStage event.
The underlying partner FAQ is dated July 20 and marked proprietary and not for distribution, so this entry cites the published report and omits the technical indicators of compromise the document contains. None of these points appeared on TruStage's public pages at capture.
TruStage opened a central outage hub at trustage.com/outage, routing individuals and businesses to service-specific pages, claim filing, and the 1-833-374-1541 support line.
TruStage stood up a central resource hub at trustage.com/outage, dated July 24. It repeats that the company identified a cybersecurity incident affecting its environment, that systems remain down while teams work to establish the facts, and that outside experts and business-continuity plans are engaged.
The hub routes individuals and businesses to service-specific pages, claim filing, and retirement-solutions support, and lists the 1-833-374-1541 support line. It gives no restoration timeline and no finding on data, and continues to call conclusions about scope premature.
TruStage now states it directly on its own site, in a CEO video: July 11 detection, a workforce member likely downloading a malicious file as the cause, phased restoration under way, and most credit-insurance and debt-protection products running again. Still no conclusion on data.
TruStage's credit-union outage page carries a recorded update from CEO Terrance Williams, posted July 23. He says TruStage identified unusual activity on July 11 and shut systems down immediately, engaged outside cybersecurity experts, notified law enforcement, and continues notifying regulators. On cause: a member of the workforce may have inadvertently downloaded a malicious file while trying to install a legitimate tool. Investigation and recovery both remain in progress.
He describes restoration as phased and prioritized over days and weeks, with tested workarounds carrying some functions: most credit-insurance and debt-protection products running again, Liberty Mutual and Polly processing auto and home business from direct-mail leads, a GAP-waiver workaround rolling out to credit unions, bond and business-protection renewals supported, and Compliance Solutions cloud products unimpacted. A streamlined NCUA process exists for credit unions that deem the event reportable.
On data, he repeats it is premature to draw conclusions. This material had reached credit unions only through trade press until now; it is significant because TruStage is stating it directly on its own page.
A second outlet corroborates the likely cause — an employee inadvertently downloading a malicious file — and reports the phased restoration under way, adding that auto and home business is processing through Liberty Mutual and Polly.
Credit Union Daily reported that TruStage traces the incident to an employee who, per the company, may have inadvertently downloaded a malicious file while attempting to install what looked like a legitimate tool — corroborating CU Today's earlier account.
CEO Terrance Williams described a phased restoration that began the week of July 21, with manual workarounds in the meantime; he was quoted saying the company would not 'sacrifice quality, security or reliability for speed.' The report lists most credit insurance and debt protection products, auto and home processing through Liberty Mutual and Polly, GAP waiver issuance, and bond and business protection renewals as operating, with Compliance Solutions unaffected.
TruStage still called it premature to conclude whether any data was accessed. None of this yet appeared on TruStage's own newsroom or consumer FAQ.
MEMBERS Life Insurance Company, a TruStage subsidiary, disclosed the outage to annuity contract owners in a July 21 filing with the SEC. It suspended contract transactions including withdrawals, surrenders, beneficiary changes and death-claim payments, and promised to process pending requests as of the date received.
MEMBERS Life Insurance Company, the TruStage subsidiary that issues its Zone and ZoneChoice annuities, filed a prospectus supplement with the Securities and Exchange Commission dated July 21, 2026. It supplements the May 1, 2026 updating summary prospectuses for four products — TruStage ZoneChoice, ZoneChoice Advantage, Zone Income and ZoneChoice Income annuities — and its stated purpose is to notify contract owners that TruStage's systems were unavailable while it investigated the cybersecurity event. The identical supplement was filed under three separate accession numbers, one per registration statement.
The filing sets out what contract owners could not do. It describes a temporary suspension of TruStage's ability to process contract transactions, and lists investment allocation changes, cash withdrawals, surrenders, systematic withdrawals, beneficiary changes, death claim payments, dollar cost averaging and rebalancing. It notes that the disruption to online and telephone service also affected TruStage's ability to receive requests in the first place. As an interim path it directed withdrawal and surrender requests by mail to MEMBERS Life at 2000 Heritage Way, Waverly, Iowa, and cautioned that payments could be delayed by manual processing.
The most durable commitment in the filing is on timing. TruStage said pending transactions received in good order would be processed once transaction processing resumed, with systematic withdrawals, cash withdrawals and surrenders taking priority, and that it would process those requests as if they had been handled on the dates it received them. That is the same effective-dating promise its public annuity page now makes, and it is the commitment against which this week's news that outstanding monthly systematic withdrawals have been processed should be read.
Two record-keeping notes. This was the first SEC filing we found that discusses the incident, and the tracker's earlier entry recording that none had appeared was corrected then. A full EDGAR sweep on August 18 has since found an earlier one: a July 20 supplement for a separate set of variable annuities, logged separately, so the earliest SEC disclosure is July 20 rather than July 21. And the supplement dates the shutdown differently from TruStage's public pages: it says TruStage proactively shut down many of its systems on July 10, while the outage pages and consumer FAQ date the identification of the attack to July 11. Both dates are recorded here as each source states them; nothing published resolves the difference.
Trade press: TruStage has begun a phased recovery, with most credit-insurance and debt-protection products operating again — and investigators believe the incident began with an employee inadvertently downloading a malicious file.
CU Today reported that TruStage has entered recovery, bringing systems back in a controlled, prioritized sequence expected to span days and weeks. Most credit-insurance and debt-protection products are operating again, with temporary manual workarounds supporting some claims, GAP waivers, and bond and business-protection renewals; cloud-based Compliance Solutions were unaffected.
Investigators reportedly believe the incident began when an employee inadvertently downloaded a malicious file while installing what appeared to be a legitimate tool; TruStage detected unusual network activity on July 11 and shut systems down to contain it. CEO Terrance Williams was quoted saying the company would 'be methodical.'
TruStage still calls it premature to say whether any data was accessed, and says it is coordinating with outside experts, law enforcement, and regulators, including a streamlined NCUA reporting path. Separately, American Banker reported no ransom demand and no threat-actor activity since discovery. These details came from trade press and were not yet on TruStage's own pages.
SEC filings from TruStage subsidiary MEMBERS Life confirm annuity transactions — withdrawals, surrenders, beneficiary changes, death-claim payments, new contracts — are suspended during the outage, with mail-in interim options for some requests.
MEMBERS Life Insurance Company, the TruStage subsidiary that issues annuity contracts, filed prospectus supplements with the SEC on July 20-21 (Forms 497/497VPU) disclosing that the incident has disrupted its operations.
The filings say the company temporarily cannot process a range of contract transactions — cash withdrawals, surrenders, systematic withdrawals, beneficiary changes, death-claim payments — and cannot issue new contracts while systems are restored; interim mail-in arrangements cover certain requests.
The filings do not state that any non-public personal information was accessed, and no restoration date is given. Members holding TruStage annuities may see delays in these transactions.
A second TruStage separate account disclosed the outage to the SEC on July 20, a day earlier than the filings already tracked. It covers the MEMBERS Zone, MEMBERS Horizon and TruStage Horizon II annuities, suspending the same list of contract transactions.
MEMBERS Horizon Variable Separate Account, a MEMBERS Life Insurance Company separate account, filed a Form 497 prospectus supplement dated July 20, 2026. It supplements three statutory prospectuses dated May 1, 2026 — the MEMBERS Zone Annuity, the MEMBERS Horizon Variable Annuity and the TruStage Horizon II Annuity — and the filing states its own purpose plainly: to notify contract owners that TruStage systems were unavailable while it investigated a cybersecurity event.
The substance matches the July 21 supplement this tracker already records. It describes a temporary suspension of TruStage's ability to process contract transactions, listing investment allocation changes, cash withdrawals, surrenders, systematic withdrawals, beneficiary changes, death claim payments, dollar cost averaging and rebalancing, and notes that the disruption to online and telephone service also affected TruStage's ability to receive requests at all. It routes withdrawal and surrender requests by mail to Waverly, Iowa, warns that manual processing may delay payments, and makes the same effective-dating commitment: pending transactions received in good order after July 10 would be processed once processing resumed, as if handled on the dates received, with systematic withdrawals, cash withdrawals and surrenders given priority.
Two corrections to the record follow. First, the earliest SEC disclosure of this incident is July 20, not July 21; the tracker's July 21 entry said it was the first filing found, and that sentence has been corrected. MEMBERS Life filed seven Form 497s of its own the same day, before the larger July 21 batch. Second, the product scope is wider than recorded. The previously tracked filings covered the index-linked ZoneChoice family; these cover variable annuities, a distinct set of contract owners who were not represented in the tracker's account of which TruStage products the outage reached.
This came out of a full EDGAR sweep of all form types from July 10 through August 18, which returned 68 keyword hits. Every hit outside this July 20–21 cluster matches a noise class already documented in the research routine — fund portfolio holdings of TruStage debt, an insurance-carrier risk factor, private note purchase agreements signed by TruStage's investment arm, and two effectiveness-delay filings that name nothing. No 8-K exists and none should be expected: TruStage Financial Group is not an SEC-reporting equity issuer, so these insurance-product supplements are the only channel through which the incident reaches EDGAR. This filing also dates the proactive shutdown to July 10, against the July 11 identification date on TruStage's outage pages — the same unresolved discrepancy already noted on this page.
TruStage advanced its consumer FAQ's status stamp to July 19 with no substantive change: systems still down, no restoration date, no data-exposure finding.
TruStage refreshed the status line on its consumer FAQ to July 19, 2026, 11:15 a.m. CT. The substance did not change: systems remain shut down while the company works to restore them, customers may still have trouble reaching accounts or completing transactions online, and TruStage says it is premature to draw conclusions about the scope or impact of the incident. No restoration date and no data-exposure finding were given.
TruStage pointed customers to newly launched resources — a consumer FAQ, an online claim-start page, and the support line 1-833-374-1541 — while systems remain down.
In an update posted to its newsroom, TruStage said it had activated its incident response and recovery protocols and engaged outside cybersecurity experts. With its systems still down, the company directed customers to newly launched resources: a consumer FAQ, an online page to start a claim, and a support line at 1-833-374-1541.
TruStage's consumer FAQ confirms systems were proactively shut down and warns customers may have trouble reaching accounts or completing transactions. The company calls it premature to say whether any data was accessed.
TruStage's consumer FAQ (marked last updated July 16) describes the situation as under investigation, with systems proactively shut down while restoration continues. Customers may have difficulty accessing account information, completing transactions, or submitting requests online; delayed 401(k) access and how to file claims are specifically addressed.
TruStage said it would be 'premature to draw conclusions about the scope or impact' of the incident, including whether any data was accessed.
Members can start a claim online through TruStage's new form while systems are down. It deliberately collects no policy, account, or Social Security numbers — a useful anti-phishing detail to share.
TruStage opened an online form for consumers to begin a claim while systems are down, covering protected-loan, death-or-dismemberment, and business-protection claim types, and says it will follow up as soon as possible. Rather than collecting sensitive details, the form asks members to choose a relationship and a preferred contact time, and cautions users not to include policy, contract, account, or Social Security numbers.
TruStage Compliance Solutions says its cloud products are not affected and clients can keep using them as usual.
TruStage Compliance Solutions posted a notice on its community portal saying it was aware of the cybersecurity issue TruStage had announced, and that its own cloud products were not affected. Clients were told they could keep using those applications as usual, and the notice repeated that the outage did not originate in Compliance Solutions technology. The notice did not address the cause or scope of the wider TruStage incident.
TruStage publicly disclosed a cybersecurity incident, activated its incident-response procedures, and engaged outside experts. It did not say whether any data was accessed.
TruStage disclosed that it had detected a cybersecurity incident affecting its environment and immediately activated its incident-response and recovery procedures. The company said it engaged outside cybersecurity experts to assist with containment, remediation, and recovery, and that the work remained ongoing. It said it was still establishing the facts and did not indicate whether any data had been accessed or name specific affected systems.
Credit Union Daily reported TruStage voluntarily shut down portions of its network after detecting suspicious activity, with no word on ransomware or whether any data was accessed.
Credit Union Daily reported that TruStage had voluntarily shut down portions of its network after detecting suspicious activity, triggering its incident-response protocols alongside third-party specialists. The outlet emphasized that TruStage had not indicated whether ransomware was involved or whether any customer or employee information had been accessed.
The disruption is confined to TruStage products — GAP, mechanical repair coverage, and payment protection claims. A partner credit union's own deposits, cards, ATMs, and online banking were unaffected.
Coverager highlighted the downstream effect on a partner institution: First Commonwealth Federal Credit Union told members that TruStage was temporarily unavailable for GAP, mechanical repair coverage, and payment protection claims. The report noted the disruption was confined to TruStage products offered through the credit union and did not affect the credit union's own deposits, cards, ATMs, or online banking.
Service Desk access was restored the afternoon of July 14; tickets submitted during the two-day outage are being worked in the order received.
TruStage Compliance Solutions reported that Service Desk access was fully restored as of 3:20 p.m. ET on July 14, two days after the outage that began the morning of July 12. The team said it could again view and process the support tickets submitted while access was unavailable, and that those tickets would be worked in the order received. The notice did not say what caused the outage or whether it was related to the broader TruStage incident disclosed the following day.
TruStage Compliance Solutions' Service Desk went offline the morning of July 12 — two days before TruStage's disclosed incident — delaying support-ticket responses. TruStage has not said whether the two are connected.
A notice on TruStage Compliance Solutions' community portal reported that as of 8:30 AM ET on July 12 a systems outage was preventing its team from accessing the Service Desk, delaying responses to support tickets. The notice said the outage was not related to Compliance Solutions technology and directed clients and partners to email support addresses instead. TruStage has not publicly said whether this outage is connected to the broader incident it disclosed on July 15.
