MADISON, Wis. — TruStage has published an updated list of FAQs related to the July 11 cybersecurity incident that has shut down many of its systems.
In the new FAQs, TruStage confirms what its CEO, Terrance Williams, said in a video last week, that the company believes the security breach is the result of an employee inadvertently downloaded a malicious file while attempting to install a legitimate utility tool.
The company emphasized that its investigation remains ongoing and that it has not yet determined the full scope of the incident, including whether customer or credit union data was accessed or exfiltrated.
According to TruStage, the company detected unusual activity on its network July 11 and immediately activated its incident response and business continuity plans. The company said it notified law enforcement and engaged cybersecurity firm Mandiant to assist with investigating, containing and remediating the incident.
As part of its response, TruStage proactively took certain systems offline as a precaution.
The company said that, based on its investigation to date, it has not observed any additional threat actor activity since July 11, when the incident was detected and containment efforts began.
No Common Vulnerabilities and Exposures
While the investigation continues, TruStage said it has not identified any known Common Vulnerabilities and Exposures (CVEs) associated with the compromise.
The company also said it has not observed the threat actor interacting with files shared through third-party systems, portals, virtual private networks, APIs or other environments connected to TruStage. However, it cautioned that investigators are continuing to determine whether customer or partner data was accessed, exposed or stolen.
TruStage said it is not yet able to provide written assurances to individual credit unions regarding whether their data was affected because the forensic investigation remains incomplete.
Some Questions Remain Unanswered
The company declined to answer several questions, including when the threat actor first gained access to its network, how long the attacker remained in its systems, the specific type of cyberattack involved and whether any threat actor has claimed responsibility. TruStage said releasing those details would be premature or inappropriate while the investigation is underway.
To assist partners with their own security monitoring, TruStage said it has released several indicators of compromise, including two IP addresses and several domains associated with the investigation. The company noted that the underlying “b-cdn.net” domain itself is not considered malicious.
TruStage said it has notified applicable regulatory authorities and will continue to do so as required. It also confirmed it has informed the National Credit Union Administration of the incident. The company said credit unions that determine the incident is reportable should contact the NCUA directly and identify their notification as relating to the TruStage cybersecurity event.
Other Key Updates
Among the key updates provided by TruStage:
- The incident was first detected on July 11 after unusual network activity was identified.
- Investigators believe the attack may have originated from an employee inadvertently downloading a malicious file while installing a legitimate utility application.
- Mandiant is leading the forensic investigation and remediation efforts alongside TruStage.
- The company said it has not observed additional threat actor activity since July 11.
- The investigation has not yet determined whether customer, partner or credit union data was accessed or exfiltrated.
- TruStage said it has not identified any known CVEs connected to the incident.
- The company said it has not observed attackers moving into connected third-party systems or environments.
TruStage said it will continue providing updates to its credit union partners as additional facts become available through the ongoing forensic investigation.
Litigation Filed
As the CU Daily has reported, one credit union has already filed a lawsuit against TruStage over the security incident, while one class action law firm has indicated it is seeking plaintiffs for potential litigation against both individual credit unions and TruStage.
The FAQs can be found here.
26 Responses
bottom line is tru stage is unwilling to give details about the matter. Why? the whole affair does not pass the smell test.
100% agree
As millions of customers financial future literally hang in the balance, this CEO thinks it’s acceptable to give an update every week or so? Unbelievable.
Not really updates, either. Just the same information with a new date.
Over two weeks with almost no release of information is making me increasingly anxious.
We have been trying to contact TruStage regarding an insurance policy regarding a death that we have had to pay for up front which has caused a final hardship. TruStages issues have gone on too long … this would apply to any company
In this day and age financial institutions staffing must have personnel who can provide information as to interrupted financial and insurance coverage, payments to and from the institution and what can/ should be expected by those you have or are in the process of starting an account or insurance through trustage. Options should be made available wherever possible and clear picture of worse case scenarios.
tru staage is not so TRUE> maybe change name back to Cuna Mutual. at least compant does not have to deal with truthfulness
tru staage is not so TRUE> maybe change name back to Cuna Mutual. at least company does not have to deal with truthfulness
This has gone on too long – fix the system, get us back into our retirement accounts and offer us complete credit coverage for yet another screw up by a large entity who should be on this like a rash to avoid it happening – too slow, too late, too long. Get information to the people you rely on for your jobs!
Agreed from a TruStage participant that has their retirement IRA. When I called I got a person that could hardly speak English and had a hard time hearing her. This is not acceptable. We can even see our accounts.
So what do we do now? I’m thinking of looking elsewhere for insurance now? I want to cancel now.
I downloaded a form from the website and mailed it in to cancel my policy and also had my credit union put a stop payment on future withdrawals. Planning to get a supplemental policy with my employer.
Give us more information senior citizens especially are having a hard time worrying about their life ins policies going quiet or giving us a report once a week is insufficient what’s wrong with this ceo open telephone lines so we can communicate to a real person this is going on too long
Agreed. When I called I got a person that could understand English. I have a RETIREMENT IRA. Some people get money to live off of monthly and they too cannot get money out of their accounts. My question is has anyone gone public.
same useless updates that says nothing
I was not made aware of a “possible” Tru-Stage security breech until I made a request for a withdrawal of funds from my account on July 23. I was told by the local financial institution that there was a security breech at that time, and it would take 3-5 days to process my request” manually”. I did not think much of it since I had never had difficulties with withdrawals before. I made a phone call locally to ask the service provider to provide me with an update two days ago. Again, I was told it would be a 3-5day wait and that my request was still being processed. I am now into day 6. Surprisingly, I received a letter from Tru-Stage with what sounds like a staged- ” public service announcement” about the security breech today July 30th. Two days after I made an inquiry July 28. Immediately red flags went up. Soon this will place me in financial hardship. Seems like there is some very strong undercurrents going own that appear to be very questionable. I think I will have to seek legal assistance to assure that the funds I have left in my account are not part of whatever Tru-Stage is attempting to hide. I feel I should have been informed by the local services agent that funds could be held up indefinitely which would have given me time to secure other options. I am sure there are corporate people who know exactly what is going own but brushing things under the rug and giving out “public Service announcements” will not stop the exodus of clients and millions of lawsuits is there in indeed something going on behind the scenes that their hands are in.
My entire live retirement is with TruStage. I can’t get anyone to call me back by or I cannot get into my IRA. They say the annuity IRAs were affected but I can’t get to my account. Another concern, last time I checked the market was good which affected my IRA. Now how do I even know if it’s true. My credit union that does our life insurance premiums cannot even be deposited. So I’m not sure if there is a lapse in coverage. Millions of people are associated in TruStage. Give us proof. Send out letters to each participant.
I have worked in CU’s since 1975 and still do. I have had Cuna products since then and never has their communication been so poor. I find their updates to be lacking in any information to actualy make the insured feel secure. How is it that they have various links to read information why can it not all be on the same page. Their last Newroom update 7/24/2026. I feel that their total updates have lacked any confidence in my opinion. Let’s pray that this gets resolved without damage to the products thus the consumers investments.
No notice was sent to credit unions or members. No updates. Millions at risk. I think something bigger is going on here. Serious security lapses at the very least. At first they said they knew on the 10th. Now it’s the 11th. They didn’t shut down till the 15th. We found out on 19th and informed our credit union. They had no clue. TruStage is not accredited with BBB. When we opened our claim we called them and got a third party call center in what sounded like India. That was 18months ago. I expressed concern to our credit union then. When we called them about loan payments not made we again got a third party call center that sounded like India. There is something very wrong going on here. Weather it’s poor security and no firewalled offsite backups or worse, it’s very hard to say. I hope The Feds are involved either way. Class action suits are coming already.
My main concern regarding this situation is how the account balances are being tracked, particularly with investments that fluctuate daily, such as stocks and other traded securities.
tru stage said and continues to say programs will be up and running by mid august. it is august 17th and still unable to access my acct info. rest of updates is just a rehash of many useless updates.
when is the board going to take control of this shit storm?
FUBAR
aug 18th – same useless update. says nothing
another day of same message that does not provide any meaningful info.