MADISON, Wis.—TruStage President and CEO Terrance Williams said the company has begun restoring systems following the cyber incident that is likely the result of an employee downloading a malicious file, an incident that has forced it to shut down its network beginning last week. Williams cautioned that the recovery will take place over “days and weeks” as the insurer works through a phased restoration process.
In a video update to credit union partners, Williams said the investigation into the incident remains ongoing and that it is still too early to determine whether any data was accessed.
TruStage disclosed that it detected unusual activity on its network on July 11 and immediately shut down its systems to investigate.
According to Williams, the company activated its business continuity and resiliency plans, engaged external cybersecurity experts to investigate, contain and remediate the incident, notified law enforcement and said it will continue notifying regulators as appropriate as the investigation progresses.
Based on the company’s current investigation, Williams said TruStage believes “a member of our workforce may have inadvertently downloaded a malicious file while trying to install a legitimate tool.”
Recovery Underway
Williams said TruStage has now entered the next phase of its recovery, with systems being restored in a controlled, prioritized manner.
“Beginning now, we are bringing systems back online,” he said. “Over the coming days and weeks, that work will continue in a phased approach that ensures safety, stability and integrity.”
He emphasized that not all systems will become available simultaneously and that some functions will continue operating through tested and validated manual workarounds while restoration continues. “Our commitment remains unchanged,” Williams said. “We will not sacrifice quality, security or reliability for speed.”
He added that teams are working around the clock to restore operations and support credit unions and their members.
Products Returning
Williams said several business lines are already functioning or have temporary processes in place, including:
- Most credit insurance and debt protection products are operating again.
- Temporary and manual workarounds have been established for some claims notification processes.
- TruStage teams are communicating with credit union partners as those workarounds are tested and approved.
- For the company’s auto and home insurance business, Liberty Mutual and Polly are processing new business generated through direct mail leads.
- A workaround has been implemented that allows credit unions to issue GAP waivers, with partner enrollment underway.
- TruStage can continue renewing and servicing bond and business protection coverages for credit unions.
- TruStage Compliance Solutions’ cloud-based products were not affected and remain fully accessible.
Williams also noted that TruStage previously worked with the National Credit Union Administration to establish a streamlined process for credit unions that determine the incident constitutes a reportable event.
Claims, Service Top Priorities
Williams said the company’s recovery roadmap is designed to remain flexible, with immediate priorities focused on:
- Paying claims.
- Servicing customers.
- Supporting credit union partners.
- Continuing to offer insurance coverages and products.
He acknowledged that credit unions want more specific restoration timelines but said providing them remains difficult because of the complexity of the recovery effort. “The situation remains fluid,” Williams said. “Every hour and every day brings us closer to full restoration.”
Data Investigation Continues
Williams said one of the most common questions concerns whether customer or partner data was compromised.
“At this stage, it’s premature to draw conclusions about whether any data may have been accessed,” he said.
Williams pledged that TruStage will share information as it becomes available but cautioned that some details cannot be disclosed while the investigation remains active or if disclosure could create legal, regulatory, security or operational risks.
“We are absolutely committed to sharing what we can, when we can,” he said.
Ongoing Updates Promised
Williams said TruStage will continue providing regular progress reports, answers to frequently asked questions and additional video updates as meaningful recovery milestones are reached.
He closed by thanking credit unions for their patience during the outage.
“I know that you’re fielding calls, you’re getting questions and you’re offering reassurances,” Williams said. “That level of partnership will continue to make all the difference as we navigate our recovery together.”
He added that the company appreciates the support, empathy and patience credit unions have shown as TruStage continues working to fully restore its systems and services.
Lawsuit Filed
As the CU Daily reported here, one credit union has already filed a lawsuit over the incident at TruStage and is seeking class action status.
