Town of Bar Harbor
Bar Harbor network breach closes offices and disrupts systems
Summary
Bar Harbor, Maine, disconnected municipal systems after detecting a network breach on July 30, 2025, closing offices and forcing temporary workarounds. Water treatment and emergency response continued, while police network recovery extended beyond the reopening of public offices.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
Incident characteristics
Assessments
Attack mechanisms
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Remote access disruption
VPN, remote desktop, telework, remote administration, or other remote-access capabilities were unavailable or restricted.
-
Payment processing disruption
The organization could not process, receive, issue, reconcile, or record payments normally.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Records processing disruption
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
-
Public safety operations disrupted
Police, fire, emergency medical, corrections, emergency management, or other public-safety operations were materially affected.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Facility closure
One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.
-
Backlog created
The disruption caused an accumulation of unprocessed requests, cases, orders, records, appointments, or other work.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
Bar Harbor, Maine, detected a municipal network breach on July 30, 2025, and disconnected systems to contain it. Initial reporting quoting the town documented office closures for July 31 and Aug. 1 and said unauthorized access had been removed.
The town’s Aug. 1 statement described precautionary isolation of water and wastewater control systems, a freeze and replacement of municipal bank accounts, and a CrowdStrike forensic review. At that stage, it reported no detected malware, encryption, file deletion or lost funds; possible employee-information exposure remained under investigation.
Operational significance
The Aug. 8 town report provides more specific effects than early broad assurances. Police/dispatch systems were down for approximately 40 minutes while staff reconfigured a county connection; nonemergency phones were down for several hours. County 911 transfers and emergency dispatch continued. Officers used an independent mobile connection, payroll used physical checks, and staff monitored water and wastewater facilities in person while treatment remained within regulatory requirements.
Recovery extended beyond public-office reopening. The Aug. 15 report describes limited records-system access, a temporary dispatch VPN laptop, prosecution-report backlogs and processing of accumulated utility-payment checks.
Although the Aug. 19 council update broadly said systems were back online, the Aug. 22 police report still described using cruiser systems while restoring the network and county connection. The Aug. 29 report then confirmed normal patrol and dispatch operations. It said the firewall tunnel to the county records server had been attacked but no access was gained.
Confidence and uncertainty
Confidence is high in a cyber-related municipal disruption. Protective shutdowns and temporary workarounds are documented operational effects even where essential services continued.
No reviewed evidence identifies an attacker, ransomware demand, payment or a confirmed data-theft total. The initial absence of detected malware or encryption is an attributed early assessment, not a published final forensic conclusion. CrowdStrike’s response role does not imply it caused the incident.
Analytic gaps
The initial access method, full intrusion window, final forensic findings, employee-data impact and total response cost remain unestablished. The earliest supported incident day is July 30; it is not proof that unauthorized access began that day.
The earlier school-construction payment fraud and the separate PowerSchool incident are not incorporated into this network-breach record. Our Aug. 1 coverage described initial containment; subsequent town reports supply the fuller recovery sequence. No water-treatment failure, compromised county server or interrupted 911 response is established.
Operations are resolved based on the affirmative late-August recovery report. Aug. 22 is the latest precise ongoing police-network workaround observation. The exact technical completion day remains unset because the Aug. 29 report describes restoration already achieved.
Organizations involved
Impacted location
Bar Harbor, Maine
Bar Harbor is the municipal headquarters and affected office site anchor. It does not imply all locations in the town lost service.
The town jurisdiction supplies service context for closed offices, network isolation and temporary administrative/public-safety workarounds. Treatment and county emergency dispatch continued; no townwide physical utility outage is implied.
Sources
See something that needs correction?
Signed-in members can report an error, update, or missing source.