14 Lawsuits, One Unanswered Question: What the TruStage Cyberattack Means for Credit Unions

What does the TruStage incident mean for your credit union?

That depends on how your institution uses TruStage.

Leadership should be able to answer:

Those questions are part of effective third-party oversight, not just incident response. TorchLight’s recent guide to vendor risk management for credit unions goes deeper into what credit unions should be documenting and monitoring before a vendor incident occurs.

The NCUA clock and the forensic clock are different

Federally insured credit unions must notify the NCUA as soon as possible, and no later than 72 hours after reasonably believing a reportable cyber incident has occurred.

That can include third-party incidents. If a provider tells a credit union that sensitive data or business operations were compromised or disrupted, the reporting obligation may begin before the provider even completes the forensic work.

But NCUA does not expect a finished investigation within 72 hours.

The initial notice is meant to be high-level: what happened, when it was identified, which services were affected, whether sensitive information may be involved, and what the operational impact appears to be.

Member notification is a separate issue

Regulatory reporting and member notification do not necessarily occur at the same time.

NCUA guidance calls for prompt investigation when sensitive member information may have been accessed. State breach-notification laws may create additional obligations, so compliance and legal counsel should evaluate the specific circumstances.

Operational communication is different. If members are experiencing disruption, the credit union can communicate what is known without speculating about data theft:

TruStage experienced a cybersecurity incident. Certain services were affected. The investigation into potential data impact remains underway. Your credit union is monitoring the situation and will communicate directly if additional action becomes necessary.

That is transparency without getting ahead of the evidence.

The recovery strategy should matter to your board

TruStage has established a clean, isolated technology environment while rebuilding and restoring systems with assistance from cybersecurity specialists. The company says the attack was broad enough that parts of its infrastructure are being rebuilt rather than simply turned back on.

Incident response and business continuity plans should define recovery priorities, acceptable downtime, manual workarounds, communication methods, decision authority, and the conditions required before systems return to production.

Those same principles should extend into the day-to-day management of infrastructure. TorchLight’s Managed IT Services are built around proactive monitoring, patching, verified backups, recovery planning, vendor coordination, and documentation for regulated organizations.

Outsourcing a service does not outsource responsibility for managing the risk.

Two recent vulnerabilities reinforce the point

The TruStage incident also highlights why security teams cannot manage risk by waiting for perfect information or relying on one severity number.

That discrepancy is not evidence that Palo Alto is manipulating CVSS. Its 7.2 figure is a threat-adjusted CVSS-BT score that incorporates the current lack of reported exploitation.

It does, however, reinforce something we recently covered in 421 Vulnerabilities: It Only Took One : the headline CVSS number should not make the risk decision for you.

Ask instead: Is the technology exposed? What access could an attacker gain? Are attackers exploiting it? What systems depend on it? How quickly can we remove the risk?

That is also why vulnerability management works best as part of a broader managed security operation that connects detection, prioritization, containment, remediation, and executive reporting instead of treating vulnerabilities as a list of numbers.

What your credit union can do now

Your vendor can become your incident

The TruStage incident shows why third-party risk is more than a compliance exercise.

A credit union can secure its endpoints, identities, email, and network and still face operational disruption, regulatory questions, member communication challenges, and legal exposure because of a service provider.

The vendor connection is also a real attack path. In our analysis of how ransomware enters a credit union network , compromised vendors and managed devices are among the entry points credit unions need to plan for alongside stolen credentials, phishing, and exposed infrastructure.

That does not mean avoiding third parties.

It means knowing which vendors are critical, what information they hold, how quickly they must notify you, what happens if they become unavailable, what evidence they owe you after an incident, and how your institution keeps operating without them.