TruStage Cyberattack: Life Insurance Claims Only Partly Restored, Data Impact Still Unknown, and What Businesses Should Check

A cyberattack that TruStage says it identified on July 11, 2026 is still slowing life insurance claims, payments and account access almost four months later, and the company says it does not yet know whether customer information was accessed. If your credit union, your staff benefits or your company retirement plan run through TruStage, or your business leans on any one outside provider, this case is worth reading closely.

The details below come from TruStage's own outage pages as we read them on November 8, 2026. The status note on its business and retirement pages is marked last updated November 5, and the service notes on its main outage page are dated November 3. TruStage changes these pages often, so check the live versions before you act.

What happened in the TruStage cyberattack

TruStage sells life insurance, annuities and retirement plans, and its outage site has separate sections for individuals, businesses and credit unions. The company says that "we are rebuilding parts of our infrastructure so systems can be brought back safely, rather than simply turned back on." On August 13 it announced a clean, isolated technology environment, separate from the affected systems, as the base for that work.

The human cost brought this story to a wider audience. KTNV in Las Vegas reported on a family with a claim following a July 23 death. The family could not log in or reach a person, premiums kept being withdrawn, and by October there was still no decision. A check arrived after the station began investigating. TruStage told KTNV: "We recognize the frustration delays and waiting periods have caused."

TruStage data breach: what is confirmed and what is not

People are searching for a "TruStage data breach," but TruStage has not confirmed that any data was taken. Here is how the evidence divides.

Stated by TruStage

• The attack was identified on July 11, and recovery is phased.
• "Retirement plan assets were not impacted and remain invested," according to its retirement page.
• "Customers will not lose coverage due to an inability to make a payment during this service disruption," according to its individual page.

Claimed, and not something we could check

TruStage's business page says: "Based on the forensic evidence reviewed to date, Mandiant states that TruStage's operating environment is clean, the incident is contained, and it has identified no indication of any active intrusion." The same page says "Mandiant has not identified threat actor activity within the environments in scope since July 11, 2026," and that Mandiant updated its investigation memo on October 9.

That memo is password protected, so we could not read it. We are relying on TruStage's description of it. The pages we read do not define which environments were "in scope," and a clean environment today does not answer whether information was accessed in July.

Alleged in court

American Banker reported on August 12 that at least 14 proposed class actions were pending in federal court in the Western District of Wisconsin, including one from a credit union seeking its outage costs. A medical practice that runs employee 401(k) plans through TruStage was later added to that case. KTNV reports that at least 14 suits have been consolidated into a class action alleging inadequate safeguards. These are allegations, not findings. We have not read the complaints, and American Banker reports that TruStage does not comment on pending litigation.

Not known

• Whether any customer information was accessed. TruStage says it is still investigating "whether any information was accessed."
• How the attackers got in and who they were. The TruStage pages we read do not say.
• How many people could be affected.
• When answers will arrive. On August 13, TruStage said "it will likely be 2 to 3 months from now before we have those answers." That window closes in mid-November.

Is TruStage back up? Current claims status

In August, TruStage was targeting mid-August for basic servicing at most businesses. Its claims dashboard still shows a mixed picture:

One-time payments, withdrawals and surrenders are also listed as partially available on the main outage page.

What to do this week if you use TruStage

Why a vendor cyberattack matters for your business

The damage in this case does not depend on stolen data. Even with the data question open, customers have waited on claims, and businesses have worked around limited systems for months. Outage risk belongs in your vendor reviews alongside data risk.

Before you sign or renew with a provider your business cannot run without, ask:

• If your systems were down for a month, how would we file, pay or get paid?
• How would you reach us if your own email and phones were down?
• How quickly will you tell us about an incident, and does the contract say so?
• Will you share an independent investigator's findings with us?
• Can we hold a current export of our own records?

Then check your side. List the providers that would stop your operation, name who owns each relationship, keep offline copies of key records, and ask your insurance broker whether your cyber policy covers losses caused by a vendor's outage.

TruStage cyberattack questions people are asking

Was my data stolen in the TruStage breach?

Nobody can say yet. TruStage says the investigation continues and that it "will notify anyone affected directly with next steps" if customer information was accessed.

Is my 401(k) safe with TruStage?

TruStage says retirement plan assets were not impacted and remain invested. Online access is returning in phases, and balances shown may be as of a past market-value date.

Will I lose my life insurance if I cannot pay during the outage?

TruStage says customers will not lose coverage because they cannot make a payment during the disruption, and that grace period accommodation remains in place.

How do I file a TruStage claim during the outage?

Start from the individual page or call 1-833-374-1541. If you already filed, TruStage says not to file again.

Is there a TruStage class action lawsuit?

Yes. At least 14 suits have been reported, in federal court in Wisconsin. No court finding of fault has been reported in the sources we reviewed.

The bigger lesson

A provider's outage becomes your outage, and your customers will not care whose server failed. The time to learn how a vendor behaves in a crisis is before you depend on it, while you can still change the contract or add a fallback.

To map which providers your business depends on and what breaks when one goes down, see our security hardening work or request a quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: TruStage outage page; TruStage business page; TruStage retirement page; TruStage individual page; TruStage claims status; TruStage August 13 release; KTNV; American Banker.