First Commonwealth Federal Credit Union, a member-owned credit union based in Pennsylvania’s Lehigh Valley, recently notified members that a cybersecurity incident at one of its technology vendors, TruStage, disrupted certain insurance services offered through the credit union. Vendor-side incidents like this one can still put member data at risk even when the credit union itself was not directly hacked, because vendors often store or process sensitive personal information on a company’s behalf. Financial institutions that rely on third-party vendors have a responsibility to ensure those vendors properly safeguard any personal information entrusted to them.
First Commonwealth Federal Credit Union’s Data Breach Investigation
According to public disclosures, TruStage, a Madison, Wisconsin-based insurance, investment, and technology provider, detected a cyberattack affecting its environment and proactively shut down portions of its network to contain the threat. TruStage first disclosed the incident around July 15, 2026. The shutdown temporarily disrupted several insurance-related services that TruStage provides through credit union partners nationwide, including First Commonwealth, affecting members’ ability to submit claims for GAP insurance, mechanical repair coverage, and payment protection products. As of this writing, TruStage has not publicly confirmed the specific types of personal information, if any, that may have been accessed during the incident, and the investigation remains ongoing.
Vendor-related data incidents have become increasingly common across the financial services industry, as credit unions and banks routinely outsource insurance, payment processing, and other services to third-party technology providers. When one vendor serves many financial institutions at once, as TruStage does for numerous credit unions across the country, a single cybersecurity incident can potentially affect a large number of members spanning multiple institutions simultaneously. This type of concentrated risk is part of why regulators increasingly scrutinize the security practices that financial institutions require of their vendors.
Even when a company has not confirmed that specific personal data, such as Social Security numbers or account details, was accessed, members whose financial institution relies on an impacted vendor are often understandably concerned about the potential exposure of their information. Financial account information combined with identifying details can be used to facilitate identity theft, unauthorized transactions, or account takeover fraud, which is why any disruption tied to a cybersecurity incident, even one without a confirmed data compromise, is worth taking seriously.
When Did This Breach Occur?
TruStage disclosed that it detected the cyberattack affecting its environment on or around July 15, 2026. First Commonwealth Federal Credit Union posted a notice shortly afterward alerting members to the resulting service disruptions.
What Information Was Breached?
As of this writing, TruStage has not publicly disclosed the specific types of personal information, if any, that may have been accessed during the incident. The investigation remains ongoing, and TruStage has indicated it will provide additional updates as more information becomes available.
What You Can Do
If you are a member of First Commonwealth Federal Credit Union or received a notice regarding this incident, consider taking the following steps to help protect yourself:
- Monitor your credit union accounts and any linked insurance policies for unusual activity.
- Watch for official updates from both First Commonwealth Federal Credit Union and TruStage regarding the scope of the incident.
- Regularly review your credit reports from Equifax, Experian, and TransUnion for unfamiliar accounts or inquiries.
- Be cautious of phishing emails or calls referencing this incident, and never provide personal information in response to an unsolicited request.
- Consider placing a fraud alert or credit freeze with the major credit bureaus if you have concerns about your information.
File a Data Breach Lawsuit Against First Commonwealth Federal Credit Union
If your personal information was exposed as a result of this incident, you may have legal options available to you. Financial institutions and the vendors they rely on have a responsibility to protect the personal information entrusted to them, and when that data is compromised, affected individuals may be entitled to compensation for the risks and burdens they now face.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
