AUGUST 2026
The US EPA, FBI, Cybersecurity & Infrastructure Security Agency (CISA), and Water Information Sharing & Analysis Center (WaterISAC) have held urgent briefings regarding active and on-going cybersecurity breaches at dozens of Public Water Systems (PWSs) in at least seven states across the U.S. The targeted PWSs range in size from small to large.
Many wastewater systems use similar technology as found in the drinking water sector. A common symptom of these breaches includes a loss of PLC connectivity with devices. These incidents all involve vulnerabilities related to PLCs, as described in the Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure advisory (PDF).
The Federal Bureau of Investigation (FBI) has information and guidance regarding malicious cyber actors targeting PLCs.
"Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-Facing Programmable Logic Controllers, Causing Operational Disruptions" is a brief description of the current threat landscape pertaining to PLCs.
"Restoring Access to a MicroLogixTM 1400 Controller When the Password is Unknown" offers guidance on restoring access to a PLC when the password is unknown.
The Maine DEP strongly recommends that all Maine POTWs follow the recommended mitigations in the above linked advisories as soon as possible. US EPA recommends the following guidance for secure connectivity of operational technology (OT): Secure connectivity principles for Operational Technology (OT).
Briefly, remember to:
- Use strong passwords.
- Change default credentials.
- Separate Information Technology (IT) from OT.
- Remove PLCs from direct internet exposure via secure gateway and firewalls.
- Work with integrators and service providers to protect your assets.
Please report suspicious activities and incidents to your technology provider, law enforcement, and your DEP Inspector if you suspect a cybersecurity breach. Here are a list of email contacts for your information:
Due to the heightened threat level, the DEP reminds all POTWs to remain vigilant regarding potential cybersecurity threats.
The Cybersecurity & Infrastructure Security Agency (CISA) “Shields Up” webpage offers information on how to prepare for, respond to, and mitigate the impact of a cyberattack.
|
The Cybersecurity and Infrastructure Security Agency (CISA) is currently observing a significant increase in cyber threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) Sector. CISA urges critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible. Threat actors targeting exposed PLCs have modified passwords to lock out operators and disconnected the PLCs by changing their IP addresses. This activity has resulted in boil water notices and sustained manual operations.
These threat actors are targeting water entities of all sizes. Even water organizations with mature cybersecurity processes should validate their external connections, as this targeting activity includes cellular modems installed by operators, vendors, or system integrators that may not be documented or included in routine attack surface scans. OT assets exposed to the internet have an increased risk of defacement, configuration changes, operational disruptions, and, in severe cases, physical damage. While CISA is not attributing the activity to any specific threat actors, the mitigation guidance provided by the recent Joint Cybersecurity Advisory remains applicable: Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure.
CISA recommends organizations implement the following mitigations:
- Disconnect the PLC from the internet. Remote access for operational purposes should go through a VPN or gateway device, not directly to the PLC.
- Enable password protection and change default passwords.
- Allowlist IPs to only allow remote access from known engineering laptops or other critical OT assets.
- For Rockwell Automation devices, place the physical mode switch on the controller into run position.
After disconnecting PLCs from the internet, operators should ensure they have a known clean backup of the PLC image in case they are locked out by a modified password.
Note: Owners, operators, and integrators of Rockwell Automation MicroLogix 1400 PLCs should see Rockwell Automation’s IMPORTANT NOTICE: Restoring Access to a MicroLogix™ 1400 Controller When the Password Is Unknown for guidance addressing this activity.
To securely enable remote access to your OT systems, CISA recommends system owners, operators, and integrators see the following resources for guidance:
For additional support, contact the Environmental Protection Agency’s Cybersecurity Technical Assistance Program for the Water Sector or your CISA Cybersecurity Advisor.
To report a cyber incident, contact CISA’s 24/7 Operations Center (contact@cisa.dhs.gov), or call 1-844-Say-CISA (1-844-729-2472). Please see Reporting a Cyber Incident for more details or contact FBI’s Internet Crime Complaint Center (IC3) or your local FBI field office.
Here is the contact for Maine’s CISA Advisor:
Daisy Mueller, Cybersecurity Advisor | Maine
Department of Homeland Security
Cybersecurity and Infrastructure Security Agency | Integrated Operations Division
Cell: 202-304-6085 | Email: daisy.mueller@cisa.dhs.gov
Disclaimer
The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.
An amendment to Chapter 595: Clean Water State Revolving Fund (SRF) was adopted by the Board of Environmental Protection (BEP) on July 2, 2026 and became effective on July 8, 2026. The SRF provides financing for clean water projects. The amendment updated interest rates and fees. The Department and the Maine Municipal Bond Bank proposed the changes to make sure the fund stays strong and can keep supporting projects into the future.
On July 2, 2026, the BEP posted a proposed amendment to Chapter 579: Classification Attainment Evaluation Using Biological Criteria for Rivers and Streams for public comment. The current rule contains methods and criteria used to check if rivers and streams are healthy for aquatic life. The amendment will add new methods and criteria that will apply to additional fresh water bodies. This will help to better understand and protect our rivers, streams, ponds and wetlands. The public now has a chance to share their opinions on this amended rule. Written comments can be submitted until September 4, 2026. In-person comments will be accepted at the BEP public hearing on September 3, 2026.
If you want to learn more about either of these updates, you can reach out to Matt Hight by email at matt.hight@maine.gov or by calling 207-719-0703. To keep informed about the rulemaking process you may sign up for email notices here or visit the Department’s rulemaking page at https://www.maine.gov/dep/rules/.
Has your facility received a new MEPDES permit that contains requirements for phosphorus or nitrogen testing? It is important to note that nitrogen and phosphorous samples cannot be tested by in-house wastewater labs for compliance purposes without receiving additional certification, even if the test methods are listed in 40 CFR136. In the same way that most plants send their metals and priority pollutant samples to a commercial lab, nitrogen and phosphorus must also be tested by a laboratory state-approved for those parameters.
Maine DEP and Maine DHHS share the laboratory certification rules 10-144_CMR_Ch263_Lab-Accred-Rule_2023.pdf. These rules require that all testing for permit compliance be performed by a laboratory that is certified for that specific analyte. However, the rules allow for an exemption for wastewater labs testing their own water under certain conditions. If they test the following parameters in their in-house labs, they do not need state certification. These tests include:
BOD, CBOD, chemical oxygen demand, chlorine residual, color, conductivity, dissolved oxygen, E. coli, enterococcus, fecal coliform, pH, settleable solids, temperature, total dissolved solids, total suspended solids, and turbidity.
This exception is limited to a wastewater laboratory testing its own samples for pollutants listed on its permit or license. A facility is allowed to test samples from other wastewater treatment plants for up to 60 days of analysis per year.
So that means that anyone getting phosphorus and nitrogen compounds (ammonia, nitrate, nitrite, TKN, total nitrogen) on their permit must test compliance samples by a state-certified lab. Of course, wastewater labs can become state-certified, as several POTWs have done. However, due to fees, staffing, and increased QA/QC associated with lab certification it is typically not practical nor cost-effective for smaller facilities to become state-certified.
Any testing for process control that is not being submitted to DEP for permit compliance can be analyzed without further certification. For example, if you are testing ammonia, nitrite, and/or nitrate to regulate your nit/denit system, these samples do not need to be tested by a state-certified lab nor submitted to DEP. However, if these tests are performed in accordance with your MEPDES permit and submitted monthly through NetDMR, they must be performed in accordance with 40 CFR 136 by a state-certified lab.
If you need to find a lab to perform your analysis, a comprehensive list can be found at: AllLabs.xlsx. If you are unsure of testing requirements, please contact your DEP Compliance Inspector for more information.
EPA recently announced the WIFIA program will waive application and credit processing fees for some small communities with populations of 25,000 people or fewer. WIFIA currently charges small communities $25,000 to apply for a loan and a credit processing fee at loan closing ranging from $50,000 to $150,000, on average. The program will waive these fees while reserved administrative funds last for small communities that launch loans in Federal Fiscal Years 2026 and 2027. This offer will not apply retroactively and there will be no refunds for previous applicants.
WIFIA has additional flexibilities available for small communities including a lower minimum project cost threshold of $5 million and the ability to finance up to 80 percent of project costs. Through these features WIFIA is attempting to remove common financing barriers for small communities and make its funds more accessible.
The WIFIA program currently has approximately $11 billion in flexible financing available to support water infrastructure projects across the country, including in small and rural communities.
Visit the WIFIA program's webpage for more information on how to apply. https://www.epa.gov/wifia/wifia-public-borrowers
The opening of DMR-QA Study 46 has been delayed. EPA is currently waiting for approval by the Office of Management and Budget (OMB). EPA is anticipating that DMR-QA Study 46 will open in late August or early September. DEP will keep all participants informed of the progress.
Once the official DMR-QA study is available, Maine DEP will send the Study 46 announcement packet to DMR-QA participants in Maine. You can also go to the EPA website, https://www.epa.gov/compliance/discharge-monitoring-report-quality-assurance-study-program to download the letter when available. Once you receive the study packet, please confirm receipt with Brett Goodrich, the DMR-QA Coordinator, by emailing Brett.A.Goodrich@maine.gov.
Please review the EPA letter carefully as it contains important forms that must be filled out along with due dates for results. Be sure to check your email spam folder periodically as the announcement email may end up there.
You do not need to wait until the DMR-QA program is open to begin testing. As an alternative, PT providers also offer Water Pollution (WP) studies that are similar to the DMR-QA and are an acceptable way to satisfy DMR-QA testing requirements. Just make sure to provide your MEPDES number when ordering test samples so that DEP will get a copy of the results.
This year, facilities that have Enterococci Bacteria (Entero) in their MEPDES permit will be required to perform Proficiency Testing for Enterococci bacteria during the DMR-QA Study 46 testing period. Currently, Enterococci bacteria testing is not available under the DMR-QA program, so facilities must use a blind, WP Study to fulfill this requirement. Enterococci testing must be performed in accordance with 40 CFR 136.
If you have any questions or need to update your contact information, please contact Brett Goodrich at Brett.A.Goodrich@maine.gov or call 207-450-5590
Low Cost Nitrogen Removal in Wastewater Treatment
Excess nitrogen in coastal waters threatens aquatic life and recreation. Nutrient optimization has the potential to significantly improve water quality at minimal capital and operational costs.
In this live, virtual, no-cost training offered by the Environmental Finance Center (EFC) on August 19, 2026, attendees will learn about nitrogen removal from wastewater. A focus will be on operational changes that can help reduce total nitrogen in wastewater discharges at minimal costs, often with significant reductions in electrical and chemical demands compared to normal operations.
To register, go to Meeting Registration - Zoom.
Six-Part “Reimagining Residuals” Webinar Series
Join NEIWPCC and NEBRA in an engaging webinar series spotlighting the technologies shaping the future of sludge and biosolids management. Led by researchers and industry experts, each webinar will combine a strong technical foundation with real-world insights to explore topics ranging from established approaches like dewatering and drying to emerging and early-stage innovations. Topics and sessions of the Reimagining Residuals series include:
- Part 3: Digestion, 8/12/2026,
- Part 4: Incineration, Pyrolysis, & Gasification, 8/26/2026
- Part 5: Hydrothermal Liquefaction & Super Critical Water Oxidation, 9/16/26
- Part 6: Embryonic Stage Technologies, 10/7/26
Classes are approved for 1.5 TCHs each. For more information and to register, go to Events.
NEWEA Lab Analyst I Exam Prep with Phyllis Rand
Join NEWEA and Phyllis Rand of Compass Rose for this two-day, 4-hour course on August 25 & 26, 2026 to help prep for the NEWEA Lab Analyst Certification exam.
Participants will receive basic to intermediate instruction on laboratory practices including sampling techniques, preservation, and holding times; chemistry and solutions/dilutions; review of analytical methods and equipment for the most common wastewater parameters; microscopy basics; lab calculations, temperature conversions, and significant figures; quality control/quality assurance; lab safety; and recordkeeping.
Use this Link to register for the class.
The training class does not include the NEWEA Laboratory Analyst certification exam, which must be applied for separately. For more info on certification and how to apply for the test, go to: Laboratory Analyst Certification Program - NEWEA - New England Water Environment Association.
Upcoming Fall Events
MeWEA's Fall Convention September 17-18, 2025 at Sunday River Join MeWEA for the 34th Fall Convention at Sunday River Resort in Newry, Maine! This two-day conference is packed full of informative technical sessions, exhibit hall with all the latest water/wastewater technologies, and networking opportunities for anyone interested in the clean water and the environment.
We’ll kick things off on Wednesday, September 16, with our legendary golf tournament, a great way to network and enjoy some friendly competition.
The Convention features technical sessions approved for TCHs, an exhibition hall with designated time slots to facilitate vendor interaction, and a film screening of Unless Something Goes Terribly Wrong featuring operating staff at the Portland Water District (PWD).
And you don’t miss the 10th Annual Collection Systems Committee Cornhole Tournament. Food and beverages will be provided—come for the competition and stay for the fun!
For more information and to register, go to Events.
Building Resiliency in Maine: Manual Operations Exercises & Workshops – FREE!
Join MWUA, Tom’s Water Solutions, and the Maine Drinking Water Program (DWP) for a three-part workshop series focused on strengthening water system resiliency and emergency preparedness. The sessions are applicable to both water and wastewater systems.
This program will explore how utilities can respond to disruptions such as cyber incidents, power outages, and other operational challenges by preparing for a transition to manual operations. Participants will gain practical experience through hands-on exercises, testing procedures, and collaborative discussions to identify strengths and areas for improvement.
The series includes:
- An overview of risks and preparedness strategies
- Hands-on exercises and system testing
- Group discussions and lessons learned
The course will include three sessions: September 30, November 10, and a third date to be announced. The class is live, virtual training with in-person participation at your utility. Each sessions offers 3.0 TCHs. The class is Free (sponsored by the Maine DWP).
To register, go to: Building Resiliency in Maine: Manual Operations Exercises & Workshops - MWUA.
1. The term pathogenic means –
a. Aerobic Bacteria
b. Anaerobic Bacteria
c. Fecal Matter
d. Coliform Bacteria
e. Capable of Causing Disease
2. The minimum separation between sewer lines and potable water lines is –
a. 1 foot
b. 5 feet
c. 10 feet
d. 24 feet
e. 50 feet
3. A licensed wastewater operator is a professional who –
a. Consistently does the best job possible
b. Practices personal safety
c. Strives to improve job knowledge
d. Strives to keep the plant and collection system in the best appearance and working order
e. All the above
4. An important step in testing a sample for Total Suspended Solids (TSS) is –
a. Settling the sample
b. Filtering the sample
c. Incubating the sample
d. Burning the sample
e. Evaporating the sample
5. The Biochemical Oxygen Demand (BOD) of a sample is based on –
a. pH readings
b. Measuring Total Suspended Solids (TSS) of a sample
c. Measuring the Dissolved Oxygen (DO) used
d. Measuring the anaerobic decomposition
e. Measuring total detention time
6. The results of a Biochemical Oxygen Demand (BOD) sample taken at a treatment plant tells the operator –
a. How the plant is currently operating
b. How the plant was operating 5 days ago
c. How the plant was operating 10 days ago
d. Is of no benefit to the operator
e. How the plant will be performing at TCEQ inspection time
7. Which of the following are dangerous gases that are likely to be present in lift stations and or manholes?
a. Nitrogen
b. Hydrogen Sulfide and Carbon Dioxide
c. Hydrogen, Sulfur, and Argon
d. Oxygen, Nitrogen and Helium
e. Both a & b
8. A preferred hydraulic method of cleaning sewer lines is –
a. Cable & Auger
b. Continuous Roding Machine
c. Hydro Jet Cleaner
d. Bucket & Belt Press
e. Both a & d
9. You need to have a chlorine residual of 2.0 mg/L at the head end of your chlorine contact tank. How many pounds of chlorine do you need each day if the contact time is 15 minutes and the flow is 875,000 gpd?
a. 14.6 lb
b. 8.75 lb
c. 30 lb
d. 219 lb
10. A circular tank is 20 feet in diameter and has a depth of 8 feet 3 inches. How much water will it hold?
a. 23,876 gal
b. 19,377 gal
c. 10,845 gal
d. 2,590 gal
Answers:
1. e. Capable of Causing Disease
2. c. 10 feet
3. e. All the above
4. b. Filtering the sample
5. c. Measuring the Dissolved Oxygen (DO) used
6. b. How the plant was operating 5 days ago
7. b. Hydrogen Sulfide and Carbon Dioxide
8. c. Hydro Jet Cleaner
9. a. 14.6 lb mg/L X 0.875 MGD X 8.34 = 14.6 lb
10. b. 19,377 gal
0.785 X 20 ft X 20 ft X 8.24 ft X 7.48 = 19,377 gal
|
