Maine public water and wastewater systems appear to have dodged the wave of cyberattacks hitting other states, but local utility operators said they are fortifying their digital defenses against future intrusions.

State environmental officials, utility regulators and local plant managers confirmed this week that no public water system or wastewater facility in Maine has reported suspicious activity or system degradation like those rocking seven other U.S. states.

Nation-state hackers are targeting operational components that automate water pressure and chemical dosing by exploiting internet-connected equipment, according to joint advisories by the FBI and Environmental Protection Agency.

Most incidents have resulted in only minor operational disruptions, but cybersecurity experts warn that undetected breaches could result in altered chemical levels or water shutdowns that could impact drinking water supplies or firefighting capabilities.

The absence of reported attacks in Maine offers reassurance, but does not guarantee immunity.

“Portland Water District takes cybersecurity seriously,” said public relations director Michelle Clements. “Safeguarding our operations is an ongoing priority and an important part of maintaining the public’s trust.”

Portland Water District is Maine’s largest public water utility, serving about 200,000 people across 11 area communities. In 2024, it used a $20,000 state water security grant to conduct a cybersecurity review of its policies and procedures.

“We continuously invest in cybersecurity through technology, employee training, independent assessments, and partnerships with state and federal agencies to strengthen our defenses and protect critical systems,” Clements said.

The underlying vulnerability is the result of cash-strapped utilities linking their operational controls to the internet to save on labor costs and monitor remote equipment, regulators say. Hackers gain access by scanning for devices using weak or factory-default passwords.

According to federal threat advisories, the attacks can range from administrative break-ins stopped by firewalls to automated detection triggering a manual override of the system to a hostile takeover of the physical water treatment controls themselves.

Federal agencies say takeovers are unlikely due to manual overrides and physical backups, especially if facilities follow federal cybersecurity guidelines.

Security experts have long warned about the vulnerability of U.S. infrastructure, citing high-profile incidents like the 2021 hacking of a Tampa-area water treatment plant that allowed remote operators to boost the amount of lye in the water by 100-fold.

A plant operator caught the breach and corrected the issue as soon as the intruder logged off.

Yet many of the nation’s 50,000 public water systems remain vulnerable due to a lack of funds and dedicated cybersecurity personnel, according to federal regulators who testified before Congress in May. Municipal systems must often prioritize pipe repairs over digital security.

Legal challenges blocked the EPA’s 2023 effort to require cybersecurity audits at water utilities.

The Maine Public Utilities Commission and Maine Department of Environmental Protection say they haven’t received any recent reports of suspicious activity at Maine’s public water and wastewater facilities , although they note that rebuffed attacks do not have to be reported.

A spokeswoman for the Maine Department of Health and Human Services said Tuesday that the agency has been in regular communication with Maine’s public water systems since the latest federal alert came out, but would not say if Maine’s water systems had been targeted.

“By leveraging the expertise of local, state, and federal cybersecurity experts, (the state drinking water program) continues to help shore up Maine’s public drinking water systems against attempted attacks,” said spokeswoman Lindsay Hammes.

The program has also distributed water system asset security grants like the one Portland used to conduct its security assessment, but not all of those grants are used to improve cybersecurity — some are used for physical security, like fencing or facility cameras.

In September 2023, the Maine Office of Technology released a cybersecurity roadmap to bolster digital defenses across the state, providing local governments and rural communities with shared tools and training to protect public data and critical infrastructure from cyber threats.

A survey of local and state government entities cited in that report found that 14% of responding organizations, which ranged from school districts to county governments to public utilities, had experienced a cyber incident within the last year.