By Jeff Bassill
TruStage has spent three months telling credit unions which services are coming back. Claims intake, call center wait times, retirement account access and billing have all been covered. In my view, the question that carries the most risk for credit unions hasn’t been addressed since August: was member data accessed or taken before TruStage locked down its network?
TruStage identified the attack on July 11. That was more than three months ago.
On August 12, CEO Terrance Williams told credit union partners that TruStage was working with Mandiant and a data analysis firm, Epiq Global. He said the process was complicated enough that it would likely be two to three months before TruStage had answers on whether member data was compromised. That window Oct. 12 and closes Nov. 12. Nothing I have seen since August addresses where that investigation stands. The public outage page was updated Oct. 13, and it covers claims, servicing and disbursements without a word on data.
Worth Noting
The involvement of Epiq is worth noting, but it should not be read as evidence that data was compromised. Firms like Epiq are often brought in after a cyber incident to review files and determine whether personal information may have been involved.
Based on the information available, I am not aware of any evidence that TruStage member data was accessed or taken. The review simply means the question is still being examined, so credit unions should remain prepared for an answer rather than assume the issue was resolved when systems came back online.
Containment Answers a Different Question
Mandiant’s August 10 memo confirmed that TruStage had built a clean, isolated environment. That’s real progress, but it answers only what is happening now. Imagine coming home to find water on the kitchen floor. A plumber shuts off the main valve and confirms that no more water is coming in. The immediate problem is contained, but important questions remain: how long was the leak running, where did the water travel, and what was damaged before the valve was closed?
TruStage’s containment work is much the same. It may prevent further access, but it does not tell credit unions whether data was accessed or taken before the network was locked down. Most credit unions also still do not know whether their members’ data was on the affected systems.
Restoration was Never the Biggest Risk
An outage is costly, and members have paid for this one in delayed claims and locked retirement accounts. But an outage ends. A data compromise keeps going after the systems return, and most of its cost lands on credit unions.
If TruStage tells a credit union its members’ information was involved, that credit union has 72 hours to report to NCUA under Part 748. It is also responsible for making sure members are notified under Appendix B and applicable state law, regardless of whose network failed.
The lawsuits already show where this goes. Of the cases filed in the Western District of Wisconsin, the Peixoto suit also names Align Credit Union as a defendant, and the Nivens and Landers suits name First Financial Federal Credit Union. Members don’t separate TruStage from the credit union that sold them the product.
Put the Follow-Up in Writing
At 100 days, it’s reasonable to stop waiting for the next update and put specific questions in writing. A dated request shows your board and examiner that you asked, and it gives TruStage something concrete to answer. I would ask:
- Has the forensic review determined whether data was accessed or removed? If not, what is the revised date?
- Were systems holding our members’ or employees’ information inside the affected environment?
- Has anyone claimed to hold TruStage data or made a demand?
- Will TruStage share Mandiant’s findings beyond the August 10 containment memo?
- If our members are affected, who sends the notices, who pays for them, and what will we receive and when?
This takes your risk officer an hour. Keep the sent copy in your incident file. If you have no answer by Nov. 12, when TruStage’s own window closes, record the non-response as a finding in your vendor review and report it to your board at its next meeting.
While you’re at it, confirm your fidelity bond claims process works today. Ask how to file a loss right now, by what channel, and how long acknowledgment takes. A bond is only as useful as your ability to file against it.
What This May Mean at Renewal
My view is that TruStage keeps most of its credit union bonding business. Few carriers compete for it, and switching a bond is a heavy lift for a small credit union.
The consumer side may face greater scrutiny. GAP, mechanical repair, debt protection, credit life, annuities and retirement plans all come up for a decision eventually. Service disruptions may become one factor credit unions and members remember when those decisions arise.
Plan sponsors have their own responsibilities. A sponsor whose employees have gone months without normal access to their 401(k) accounts has a fiduciary duty to monitor that provider, so for that sponsor a review may be required.
Competitors are also likely to raise this incident in future sales discussions.
TruStage’s longstanding relationship with the credit union movement remains an important strength. Its history as CUNA Mutual has created loyalty and familiarity that likely contributed to patience during the disruption. At the same time, future renewal decisions may depend on both that relationship and how clearly TruStage addresses the remaining questions about data. A clear answer delivered first to the affected credit unions, even if the answer is difficult, would help rebuild confidence as recovery continues.
For your own planning, put TruStage’s service record since July in your next vendor review. Note which products were unavailable, for how long, and how claims were handled. When a TruStage product comes up for renewal, weigh that record and the outcome of the data investigation alongside price.
Jeff Bassill is chief financial and risk officer at Kings Federal Credit Union and founder of CU Risk Advisors, with approximately 45 years of experience in financial institutions. He can be reached at [email protected].
The views in this post are my own and do not represent the official position of Kings Federal Credit Union. Nothing here asserts that member data was accessed or taken in the TruStage incident. Comments on TruStage’s future business are my opinion about issues credit unions should weigh at renewal.
