TruStage Discloses Data Breach Potentially Affecting Millions of Credit Union Customers

TruStage, a Madison, Wisconsin-based insurance, investment and technology provider, recently disclosed a cybersecurity incident affecting its systems.

TruStage detected a cyberattack affecting its environment and proactively shut down its network to contain the threat and protect its systems. The company first disclosed the incident on July 15, 2026, stating it had "recently identified a cybersecurity incident affecting its environment."

The network shutdown temporarily disrupted some insurance services that TruStage provides through its credit union partners. According to reports published on July 16, 2026, the affected services included claims for GAP insurance, mechanical repair coverage and payment protection products. Many credit union members across the country rely on these types of coverage, which are commonly offered through TruStage's long-standing partnerships with credit unions.

As of July 17, 2026, TruStage has not disclosed the specific types of personal information that may have been accessed during the incident. The company has also not confirmed how many individuals may be affected. In its notice, TruStage stated it "will communicate appropriately as its understanding of the situation evolves."

TruStage posted a notice on its website on July 15, 2026, announcing the incident, followed by an update on July 16, 2026. The investigation remains ongoing, and the company has indicated it will provide additional updates as more information becomes available.

TruStage's response

On July 16, 2026, TruStage launched new online resources designed to help consumers access information about the incident and take action. According to the company's update, these resources include a FAQ page with up-to-date information and a page where consumers can initiate a claim. TruStage stated that "these pages are intended to make it easier for individuals to find timely information and begin the claims process."

In its initial notice, TruStage described protecting trust as a central focus of its response. The company stated that "protecting the trust of the organizations and individuals TruStage serves is a core priority." It added that it is "approaching this matter responsibly and transparently, with a focus on supporting business partners, clients and other stakeholders while response efforts continue."

TruStage also stated it is "continuing to work carefully and urgently to understand the facts" and is "working diligently to understand scope and impact of the situation, strengthen available resources, and provide updates as appropriate as the company learns more." The company asked for "the patience of its stakeholders as this work continues" and indicated it would provide further updates as warranted.

As of July 17, 2026, TruStage has not announced whether it will offer credit monitoring or identity protection services to individuals who may be affected. Consumers should watch for further communications from the company as the investigation progresses and the full scope of the incident becomes clearer.