TruStage Cybersecurity Incident

TruStage has provided materials credit unions may use when responding to member questions about the cybersecurity incident. Credit unions should review and adapt these materials as appropriate for their own communication needs and internal approval processes.

• Member Letter Template: A customizable letter credit unions can use to share current information with members.
• Talking Points and FAQs: Approved talking points and frequently asked questions for credit union staff who may receive questions from members.

Credit unions should continue to:

• Use the current support channels and temporary processes provided by TruStage
• Prepare staff and members for temporary procedures where needed
• Monitor TruStage communications and available resources regularly
• Check spam and email-filtering systems for TruStage messages
• Share relevant updates with employees and members as appropriate
• Continue collecting and maintaining documentation required for claims and temporary workarounds
• Direct product-, account-, or claim-specific questions to their usual TruStage contacts
• Continue following their own security, vendor-management, compliance, and business-continuity procedures

CrossState will continue monitoring the situation and sharing material updates and resources with members as information becomes available.

Member support remains available, although customer-service representatives may still be unable to access policy or account information, process transactions, or submit certain requests.

Members can review current information and frequently asked questions through TruStage’s individual resource hub or call 844-958-8910. Wait times may be longer than usual.

TruStage posted the Service Disruption FAQs that are available below if you’re unable to access their website.

How should debt protection and other lending claims be handled during the outage?

Dedicated response teams are actively working to restore systems and support critical business processes.

• Credit unions should continue collecting claim details and supporting documentation
• TruStage teams are actively working to restore systems and providing ongoing guidance
• Updates will be shared as information becomes available
• Our priority remains minimizing disruption for credit unions and their members while restoring services safely and responsibly

What happens if a vehicle is totaled before a GAP contract can be completed in PAX?

For claims and servicing credit unions should continue collecting claim details and supporting documentation. TruStage teams are actively working to restore systems and provide ongoing guidance. Updates will be shared as information becomes available.

What interim processes are available for lending product claims and policy processing during the outage?

Several temporary business continuity processes have been established to help credit unions continue serving members while systems are unavailable:

For GAP:

• Eligible PAX credit unions may use the approved GAP workaround
• Credit unions should maintain documentation of all sales during the outage
• Sales must be entered into PAX once service is restored

For MRC:

• Selected credit unions may use Assurant’s GLOW platform to generate quotes
• GLOW does not issue contracts
• Credit unions must track all MRC sales completed during the outage and process them in PAX after restoration

For GAP claims and servicing:

• Credit unions should continue collecting claim details and supporting documentation
• TruStage teams are actively working to restore systems and provide ongoing guidance
• Updates will be shared as reliable information becomes available

Can credit unions still provide Mechanical Repair Coverage (MRC) quotes during the outage?

Yes, a limited MRC quoting workaround is available through Assurant’s GLOW platform for a select group of high-volume credit unions.

Key points:

• GLOW can be used to generate MRC quotes and member pricing
• GLOW is for quoting only and does not issue MRC contracts
• Participation is limited due to implementation and support capacity
• Selected credit unions will receive separate communications and implementation instructions

Credit unions using GLOW can:

• Generate MRC quotes based on vehicle information
• Present pricing to members
• Finance the MRC cost as part of the loan
• Track MRC sales during the outage

Once PAX is restored, credit unions must enter the sale into PAX and issue the official MRC certificate to the member.

Will I lose coverage if I’m unable to make a payment right now?

No. Your individual coverage status is not at risk during this outage. If your policy is currently active or in a grace period, it will remain in that status until regular payment processing resumes. Once operations are restored, you will be able to make or update payments as needed.

What should I do once payment processing resumes?

Once operations are restored, you will be able to make a payment or update your payment information as needed.

What happens if I need to file a claim during this time?

If a loved one passes away during this time, or you otherwise have a claim under your individual coverage, the claim will be processed and paid in accordance with applicable policy terms and conditions once TruStage is able. To start a claim, visit trustage.com/startclaim.

Were retirement-plan assets affected?

TruStage reports that retirement-plan assets were not affected by the cybersecurity attack.

Can participants request a retirement-plan withdrawal or loan?

An interim process is available for withdrawals and loans permitted under Defined Contribution, 403(b), and Governmental 457(b) plans that do not use the Choice Group Variable Annuity product.

The process does not apply to Defined Benefit, Deferred Compensation, Tax Exempt 457(b), or Choice Group Variable Annuity plans. Eligible plans have received instructions from TruStage. Participants should contact their plan administrator for guidance regarding their particular plan.

Will participants who elected electronic statements receive their June 30 quarterly statement?

Yes. TruStage is printing paper statements for participants who elected electronic delivery for the quarter ending June 30, 2026. The statements are expected to be mailed during the week of August 10, 2026.

Should plan sponsors submit payroll files and contributions during the outage?

Files submitted through PayKonnect or Payroll Integrations may continue to be submitted and are being processed when they are in good order.

Plan sponsors whose files are not submitted through one of these third-party aggregators should not submit their payroll files or contributions to TruStage until additional instructions are provided. They should continue withholding participant deferrals and loan repayments and maintain detailed documentation regarding the delayed submissions.

When will you know more about whether data was compromised?

At this stage, it would be premature to draw conclusions about the scope or impact of the incident, including whether any data may have been accessed. We do not want to speculate or get ahead of the facts and will provide additional information as we can.

How will TruStage keep us informed about the incident and recovery?

We understand that situations like this can raise questions and concerns. As our understanding of the situation evolves, we will communicate appropriately.

TruStage states that systems were taken offline as part of its response and that services and processes are being restored only after required security and stability checks are completed.

Consumers can use TruStage’s claims resource to begin a new claim or locate the appropriate claims process for their coverage.

Credit unions with questions about their specific TruStage relationship, products, claims, or services should contact their usual TruStage representative or use the appropriate business support channel.

New Jersey and Pennsylvania credit unions can also reach out to our Compliance Hotline to speak with our BSACS and CUCE-certified compliance officers by calling 800-932-0661, option 3, or emailing compliance@crossstate.org.