TruStage Cyberattack Recovery Remains Partial After 100 Days

More than 100 days after TruStage identified a cyberattack on July 11, the insurer's public recovery dashboard still lists every displayed claims, policy-servicing and disbursement function as only partially available.

The status does not mean that no work is getting done. TruStage reports substantial restoration progress, expanded digital access and declining contact-center wait times. It does mean the event remains operationally active for credit unions and members who depend on its insurance, lending-protection and retirement services.

On October 20, TruStage's recovery-status page said some services remained unavailable. The page's latest functional update, dated October 13, marked claims submission, processing and payout as partially available. It gave the same status to one-time and recurring payments, policy management and cancellation, withdrawals and surrenders.

The recovery is measurable—and incomplete

A detailed October 9 update from CrossState Credit Union Association, based on information provided by TruStage, shows meaningful progress alongside continuing exceptions.

TruStage told the association that average call-center wait times in early October had fallen 72% for lending and 83% for life and accidental death and dismemberment compared with September averages. It expected to have adjudicated about 90% of lending claims received before the incident during the week of October 9.

The product picture was uneven. About 97% of retirement participants were on TruStage's OMNI platform and could view current balances, while the roughly 3% on its Beacon platform could see balances that might not yet be current. TruStage expected those balances to reflect current information by the end of October. Some recent payroll contributions and related adjustments might also remain absent while processing continued.

Life claims presented a longer backlog. TruStage reported that it was about halfway through paying life claims received before July 11 and had begun processing new notices received since then. Some policy changes, cancellations and disbursement requests still required manual or offline handling, and representatives might not be able to confirm individual transaction status.

For plastic-card policies, the association said TruStage was still telling credit unions not to submit claims. Submission deadlines would be extended for the hold period, and institutions were warned not to email card numbers or other personally identifiable information while a secure process was pending.

What credit unions should control now

Maintain a local exception inventory. List each affected claim, payment, policy change, cancellation, participant request and member escalation. Record the original submission date, current owner, temporary process, last vendor confirmation and next promised checkpoint. A vendor dashboard cannot replace the credit union's record of member impact.

Use product-specific status, not a single recovery label. A member with a lending-protection claim faces a different path from a retirement participant or a life-policy holder. Route staff to the applicable workflow and identify which requests remain manual, which are digitally available and which should not yet be submitted.

Protect data inside workarounds. Continuity procedures often introduce email, spreadsheets, phone calls and paper into processes that were previously automated. Confirm what information may be transmitted through each temporary channel, who can access it, where it is retained and how it will be reconciled when normal systems return.

Test the member promise. Credit unions should sample open cases and compare vendor status with what members actually experience: wait time, ability to submit, accuracy of balances, completeness of contributions, payment handling and claim resolution. Aggregate results belong in vendor-management and business-continuity reporting.

Keep the exit and concentration questions open. A prolonged outage at a major cooperative-system provider is evidence for the next contract review. Map services that cannot be performed without the vendor, recovery-time commitments, access to records, communication rights, alternative processes and the point at which a temporary workaround becomes an unacceptable operating condition.

Restoration is not the same as closure

TruStage says the breadth of the attack required parts of its infrastructure to be rebuilt so services could return safely. That is a reason for a phased recovery, but it does not eliminate the credit union's responsibility to monitor unresolved member harm and operational exposure.

The right board-level question is not whether TruStage has made progress. The evidence shows that it has. The question is whether each dependent service has returned to an acceptable state, whether backlogs and manual work are shrinking, and whether the credit union can prove that affected members are being identified and made whole.

The Sharetec outage offered the same broader lesson about shared-service concentration: recovery claims need transaction-level verification. Credit unions can use the evidence fields in our contract-monitoring controls even when the disrupted service is not an AI system.