By Patrick Whelan
The recent TruStage cyber incident has sparked important conversations across the credit union industry about what effective cyber recovery could and should look like. While TruStage is a third-party provider rather than a credit union and operates under a different business model and regulatory framework, its publicly reported response underscores a broader challenge facing financial institutions: balancing the need to restore operations quickly with the need to ensure systems are truly secure.
One reality of modern incident response is that recovery is rarely as simple as turning systems back on. Organizations must contain the threat, understand what was affected and validate that systems can be safely restored before resuming normal operations. That process requires time, coordination and a focus on long-term resilience.
While no two incidents are the same, several aspects of the publicly reported recovery efforts highlight considerations that may be useful for credit unions evaluating their own cyber resilience and recovery strategies. While the following observations are not intended to serve as a comprehensive framework, they can offer practical lessons that institutions can apply to strengthen their preparedness.
Contain the Threat Without Losing Sight of Critical Operations
When an attack is discovered, credit unions immediately face competing priorities. Operations teams want to restore services, members want access and leadership wants answers. And while all want them now, at the same time, organizations need to assess the severity of the threat and determine what actions are necessary to prevent further harm.
Containment is a critical early objective during a cyber incident. Depending on the nature of the attack, that may require taking systems offline, restricting access, isolating affected assets or accepting temporary operational disruption. While those actions can be difficult, they are often necessary to limit the attacker’s ability to move through the environment while responders assess the scope of the incident.
The key is striking the right balance between containing the threat and maintaining critical operations. Those decisions should be guided by an established incident response plan, the severity of the attack and the organization’s ability to continue delivering essential services.
Build Enough Understanding to Make Informed Recovery Decisions
Another notable aspect of the response was the emphasis on gathering sufficient information to guide recovery efforts. During a major cyber incident, organizations can feel pressure to move quickly, but effective recovery depends on making informed decisions rather than assumptions.
As both containment and recovery progress, teams need enough reliable information to answer critical questions like: How did attackers gain access? Which systems may be affected? What persistence mechanisms or vulnerabilities must be addressed? What can safely be restored, and in what order?
This is where forensic expertise can play a valuable role. By helping organizations better understand the scope and nature of an incident, investigators can support more informed decision-making throughout the recovery process. Credit unions should consider establishing relationships with forensic partners before an incident occurs, ensuring critical resources are available when they are needed most.
Restore in Business-Priority Order, Not Technology Order
One of the clearest lessons from publicly reported recovery efforts is that successful recovery is rarely about bringing systems back online as quickly as possible but restoring the right systems in the right sequence.
Recovery should be viewed as a coordinated process that balances investigation, remediation, infrastructure rebuilding, service restoration and ongoing monitoring. These activities often occur simultaneously, and new findings may require priorities to shift throughout the recovery effort.
For credit unions, restoration priorities should be driven by business impact rather than technical dependencies alone. Leaders should understand which services are most critical to members, which business processes can tolerate disruption and what recovery objectives exist for key functions.
A phased restoration strategy can help reduce risk by allowing teams to validate system integrity, monitor for signs of lingering compromise and confirm that security controls are functioning as intended before additional services are restored. The goal isn’t to simply recover quickly but confidently.
Ensure Recovery Systems Can Survive the Same Event
One lesson that deserves particular attention is the importance of protecting the recovery environment itself. Public reporting around the TruStage incident suggests portions of the recovery infrastructure were also impacted, highlighting a challenge many organizations underestimate: recovery systems must be designed to survive the same event that affects production systems.
If backups, administrative credentials and recovery tools share the same trust boundaries as production environments, attackers may be able to compromise both at the same time.
Credit unions should evaluate whether backup repositories are isolated from production systems, whether immutable backup capabilities are in place and whether administrative access to recovery environments is sufficiently segmented. Equally important is regularly testing restoration procedures. A backup strategy provides little value if an organization discovers during a crisis that recovery processes do not function as expected.
The question is not whether backups exist, but whether the institution can rebuild from a trusted environment when it matters most.
Your Vendor’s Recovery Plan is Not Your Business Continuity Plan
The TruStage incident also serves as a reminder that cyber resilience extends beyond an institution’s own environment. Credit unions increasingly rely on third-party providers for critical services, including insurance products, payments, lending platforms, cloud infrastructure and other operational functions.
When a significant incident affects a vendor, the institution may experience disruption even if its own systems remain secure.
Credit unions should assess what would happen if a critical provider became unavailable for seven days, fourteen days or even a month. Are manual workarounds documented? Are member communication plans established in advance? Do business continuity plans account for prolonged third-party outages?
Vendor due diligence remains important, but resilience requires preparing for the possibility that even well-managed providers can experience significant operational disruption.
Recognize That Recovery Extends Beyond Infrastructure
Effective cyber recovery involves far more than rebuilding servers and applications. Modern cyberattacks frequently involve compromised endpoints, user credentials and employee devices. Public reports indicate attention was also given to refreshing employee laptops, highlighting the importance of addressing potential endpoint exposure as part of recovery efforts.
Credit unions should take a similar comprehensive approach. Recovery planning must include evaluating employee workstations, reviewing privileged access, validating endpoint protections and ensuring identity controls are functioning as intended. Focusing exclusively on core infrastructure can leave organizations vulnerable even after major restoration work has been completed.
Balance Transparency With Accuracy
Cyber incidents create enormous pressure to provide immediate answers. Members, employees, regulators and business partners all want information as quickly as possible. However, investigations rarely produce complete answers overnight.
Clear, effective communication is for avoiding speculation. Organizations should communicate frequently, but it should be based on verified facts rather than assumptions.
The most effective responses acknowledge what is known, explain what remains under investigation and provide regular updates as new information becomes available. For credit unions, disciplined communication also includes meeting applicable regulatory, contractual and member-notification requirements, which may begin before a forensic investigation is complete.
Maintaining that balance between transparency, accuracy and compliance can be challenging, but it is critical to preserving trust during periods of uncertainty. Organizations that communicate clearly and consistently are often better positioned to maintain confidence among members, employees, regulatorsand business partners throughout the recovery process.
The Overall Lesson for Credit Unions
The publicly reported TruStage response highlights several elements of cyber recovery worth considering: disciplined containment, evidence-based decision-making, resilient recovery capabilities, business-prioritized restoration, vendor dependency planning and clear communication.
While every incident is different, the broader lesson is straightforward: recovery involves far more than restarting systems. Credit unions must be prepared to restore operations from trusted environments, manage third-party disruptions and make sound decisions under pressure while maintaining member confidence.
For leadership, the key questions should be: Can we rebuild from a trusted recovery environment? Do we know our backups work because we’ve tested them? Can we continue serving members if a critical vendor is unavailable for an extended period? And do we know which services need to come back first?
Organizations that can answer these with confidence are likely far better positioned to navigate the realities of modern cyber recovery.
Patrick Whelan is VP of Sales at Fortuna Cysec.
