What TruStage’s Cyberattack Means for the Preneed Policy Sitting in Your Files

Somewhere in your filing cabinet may sit a preneed or final-expense policy from a company most of your staff have never heard of. TruStage, the Madison, Wisconsin-based insurer formerly known as CUNA Mutual Group, has underwritten a huge share of the prearranged funeral policies sold through credit unions nationwide. Since mid-July, it’s also been the subject of a cyberattack that’s left funeral homes holding policies they can’t verify, can’t collect on, and — for now — can’t even get a straight answer about.

TruStage disclosed the incident on July 15, saying it had “recently identified a cybersecurity incident affecting its environment” and proactively took its network offline to contain it. The company hasn’t confirmed what data, if any, was accessed, but the impact of being offline has caused ripple effects throughout several industries, including deathcare.

TruStage says it maintains roughly 42 million consumer relationships through credit union partners, and the outage knocked out claims processing across GAP insurance, payment protection, and — most relevant to deathcare — preplanning and final expense insurance, according to American Banker. As of last week, the company says it’s begun paying claims again in several lines, including preplanning and funeral claims, and is targeting most key processes being operational by “mid-August,” per CU Today.

Verification is stalled

Houston funeral home owner and director Joe Earthman of Joseph Earthman Generations is carrying two outstanding TruStage contracts right now, and he’s blunt about what that means day to day. 

“Whether or not you can verify if a particular preneed policy is in force or has not been cashed out” is the whole problem, he says. TruStage’s own call centers can’t confirm it either. “We’ve got no idea when we’re going to get paid. We haven’t even been able to verify that these policies even exist.”

Although two contracts aren’t crippling for Earthman’s operation, he acknowledges that the more TruStage-backed contracts a firm has, the bigger the problem.

“If you had 10 to 20 contracts, that could really affect your cash flow.”

Earthman’s cases aren’t preneed contracts he wrote himself, so he is essentially fronting services on faith that a policy is both valid and collectible. In these cases, he explains to families that they have a choice: transfer to the original writing funeral home, which, as Earthman noted, “may or may not even be in the area anymore,” or stay put and let the servicing home absorb the wait. Most families, he said, choose to stay.

Earthman has been careful not to make this a customer service problem for the families themselves. They didn’t create the exposure; they just happen to be holding a policy from a company that got hacked, the same as anyone with a GAP loan or a 401(k) run through a TruStage-linked credit union.

Litigation and preparation

The month-long effects of the cyberattack haven’t just frustrated funeral homes; credit unions have been severely impacted. In fact, at least 14 credit unions have filed class action suits against TruStage on behalf of their organizations and their policy-holding members, according to Credit Union Daily. Earthman believes this incident could be a sign of similar events to come, and warns firms to be aware of how many outstanding third-party policies they hold and prepare for potential issues from policies presented at-need.

“This is kind of going away from small business to big business,” he says, “and the bigger the businesses get, the less control any individual has.”