TruStage (CUMIS) business insurance

Overview

TruStage is the insurance and financial services company built by and for U.S. credit unions, known until 2023 as CUNA Mutual Group. Its business insurance comes from CUMIS Insurance Society, which writes the bonds, liability and property policies that credit unions buy for themselves, and CUMIS Specialty Insurance Company, which backs a smaller book of niche commercial programs. The NAIC's TruStage group was ranked No. 66 among U.S. business insurers by 2025 commercial lines direct premiums written, with $1.20 billion, based on NAIC market share data. Its national top-10 line is fidelity, where it ranks sixth, reflecting the credit union fidelity bond. Other liability, mostly management and professional liability and cyber, is by far its largest line at $808.2 million.

TruStage says 84% of credit unions are its property and casualty customers. The commercial P&C book is a minority of the group, whose $6.1 billion of 2025 revenue also comes from life insurance, lending protection, annuities and retirement services sold to and through credit unions. The group is owned through CUNA Mutual Holding Company, a mutual holding company, and Terrance Williams is president and CEO. Headquarters is in Madison, Wisconsin.

History

CUNA Mutual Society was formed in 1935 as part of the credit union movement, and the organization grew alongside credit unions into life insurance, lending protection, retirement and property and casualty lines. CUMIS Insurance Society is the property and casualty company that writes coverage, including the fidelity bond, for credit unions themselves.

TruStage began about a decade before the rebrand as the brand for one of the company's largest product lines. After more than a year of work, CUNA Mutual Group launched TruStage as its single brand in 2023, and the retirement and executive benefits units followed in late 2024. The P&C company keeps the CUMIS name on its policies. Since 2018, CUMIS has also written specialty commercial programs through outside program administrators, which is how a credit union insurer comes to write general liability for contractors and retailers.

On July 11, 2026, TruStage identified a broad cyberattack, shut down its network and disclosed the incident on July 15. It brought in Mandiant and chose to rebuild parts of its systems rather than switch them back on. By August 12, American Banker counted 14 proposed class actions in federal court in Wisconsin, brought by credit unions, businesses and consumers. TruStage has said it did not yet know whether member data was accessed. As of its October 6, 2026 update, claims submission, processing and payment were still only partially available, and Mandiant reported no threat-actor activity since July 11.

Business insurance products

Business Protection for credit unions. This is the core commercial book, sold as a coordinated suite so a credit union can report a loss without first working out which policy applies:

• Fidelity bond (the CUMIS Fidelity Bond): employee dishonesty, robbery, forgery and other fraud, with enhancements for fraudulent ACH debits and booster payments, electronic cash letters, and trauma counseling and injury payments after violent acts. See employee theft coverage and fidelity bonds: what they cover and who needs one.
• Management and professional liability: management (D&O), fiduciary, employment practices, professional, lender and personal excess liability for the credit union, staff, directors and volunteers. See Directors and officers (D&O) insurance explained.
• Cybersecurity Protection: data breach liability and expense coverage for hacking, malware, business email compromise, ransomware and social engineering, with risk management, legal, computer forensic and breach resolution services and access to Beazley prevention resources.
• Property and business liability: buildings, ATMs and general liability, with recent extensions for paved surfaces and imminent collapse.
• Business auto for owned, non-owned, hired and repossessed vehicles; plastic card fraud coverage; and auto and real estate collateral protection that protects the credit union's loan collateral when a borrower lets insurance lapse.
• Workers' compensation through a group program with The Hartford, with premiums based on actual payroll, coverage for volunteer directors and security guards, and potential profit-sharing payouts based on group loss results.

Specialty Commercial Programs. General liability, property, auto, inland marine, umbrella, professional liability and crime, monoline or multiline, admitted or non-admitted, written countrywide through program administrators in professional services, manufacturing, commercial property, habitational real estate, retail and construction.

Who it insures

The main market is credit unions, from small single-branch shops to large regional institutions. TruStage's advantage is depth in one industry: its bond and management liability forms are written around credit union operations, regulators and lending, and its risk and compliance consultants work only with credit unions.

Other businesses meet TruStage only through a specialty program, usually without seeing the brand until the policy arrives. If your general liability or property policy is issued by CUMIS Specialty, the program administrator, not TruStage, handles underwriting and often claims.

How to buy

Credit unions buy directly through TruStage account representatives; call 800-356-2644 or the Business Protection Customer Response Center at 800-637-2676. Renewals use a Required Renewal Questionnaire (RRQ); TruStage said the RRQ was unavailable during its system recovery and that credit unions would get extra time to complete it. Policy changes and certificate requests go to [email protected] during the recovery.

Specialty program business is placed by the agents and brokers who work with each program administrator. TruStage's site offers no online quoting for business insurance.

Claims

Business Protection claims (bond, business auto, collateral protection, cyber and security incident, management and professional liability, plastic card, and property and business liability) are reported at 844-337-5828, fax 608-231-7900, or online through TruStage's claim portals. After the July 2026 attack, first notice of loss can be filed at trustage.com/startclaim. As of October 2026, TruStage asked credit unions to hold plastic card claims until a secure submission process is ready, extending the filing window by the length of the hold.

The cyber product comes with legal, computer forensic, breach resolution and mitigation services, and management liability claims get a third-party litigation team. For bond losses, the credit union is the insured, so report the loss in writing promptly; see commercial crime insurance: what it covers and what it excludes for how discovery and notice conditions work.

Financial strength and ratings

CUMIS Insurance Society carries an A (Excellent) Financial Strength Rating from AM Best, affirmed in December 2025, an A+ from S&P, affirmed in September 2026, and an A2 from Moody's, reviewed without change in January 2026, all with stable outlooks, according to TruStage. CUMIS Specialty is rated A by AM Best, in Financial Size Category XII ($1 billion to $1.25 billion of adjusted policyholders' surplus), and is not rated by S&P or Moody's.

For the whole TruStage group, the company reported 2025 revenue of $6.1 billion, net income of $312 million, total surplus of $4.3 billion and assets of $49.7 billion. The 2026 cyberattack and the proposed class actions over it had not been resolved as of October 2026.

Strengths and weaknesses

TruStage knows credit unions better than any other insurer, and that is both its strength and its limit. For any other business it is a behind-the-scenes program carrier.

• Strengths: Credit union-specific bond, D&O and cyber forms, with risk and compliance consultants who work only with credit unions. Ranks sixth nationally in fidelity. Strong ratings from all three agencies (A, A+, A2). One account team for P&C, lending protection and benefits.
• Weaknesses: The July 2026 cyberattack left claims and servicing only partially restored for months and drew 14 proposed class actions by August 2026; plastic card claims were still on hold in October 2026. Outside credit unions, coverage comes only through program administrators. Workers' compensation is a partner program with The Hartford, not CUMIS paper.

How to contact TruStage (CUMIS)