A Credit Union Is Suing Its Own Vendor Over a Cyberattack. Here's What Every Contract Should Say

When a vendor gets hit by a cyberattack, whose problem is it? A Pennsylvania credit union is asking a federal court to answer that question, and the result could change how every credit union reads its vendor contracts.

Here's the short version. In mid-July, TruStage, a major provider of insurance and financial products sold through credit unions, discovered a cybersecurity incident and shut down its network. Credit unions and their members lost access to a range of services. Claims for GAP coverage, mechanical repair coverage, and payment protection stalled, and according to the lawsuit, people were locked out of accounts including employee 401(k) plans. TruStage says it protects 42 million consumer relationships, which gives you a sense of how widely the disruption spread.

Bessemer System Federal Credit Union filed a proposed class action, arguing that TruStage did not deliver the security it promised. As of the public reporting we reviewed, TruStage had not said how the attackers got in, who was behind it, or whether any member data was accessed. Member notices from several credit unions in July and August said TruStage was restoring services and that the problem was inside TruStage's systems, not the credit unions' own.

Why this one deserves your attention

Most credit unions that sell TruStage products did nothing wrong. Their own systems were fine. But their members still couldn't file a claim, and the phone calls still went to the credit union. That's the core lesson about vendor risk: you can be harmed by a failure you had no part in, and you're still the one members call.

This also lands in the same week regulators proposed new vendor risk guidance, with the NCUA among the agencies. The proposal pushes institutions to match their oversight to how much damage a vendor could do. TruStage is a good example of a vendor that sits quietly in the background until the day it matters.

Five contract questions worth asking now

1. How fast must the vendor tell you about an incident, and does the contract define what counts as one?
2. Does the vendor carry cyber insurance, and who gets paid first if something goes wrong?
3. Is there a cap on the vendor's liability, and does it cover the real cost of a multi-week outage?
4. What can your staff do for members while the vendor is down? Even a simple manual workaround for urgent requests helps.
5. Which vendors would stop something members depend on if they went offline tomorrow? If you can't list them in five minutes, that's your first project.

What to take from the lawsuit itself

Nobody knows yet how it will turn out, and it would be a mistake to treat a filed complaint as a finding. What it does show is that credit unions are starting to test whether security promises in a vendor's marketing and contract can be enforced. That makes the wording of those promises worth reading before you sign, not after something breaks. This isn't legal advice, so have counsel review any contract language you plan to rely on.

Sources

• Credit union sues TruStage over cybersecurity incident (American Banker)
• Credit union files class action against TruStage after cyberattack (CU Insight)
• TruStage shuts down network following cybersecurity incident (Coverager)
• Member notice: TruStage cybersecurity incident (America's Credit Union)
• TruStage Cybersecurity Incident, updated August 12, 2026 (USC Credit Union)