Cyberattacks target water systems in 12 states, exploiting weak industrial computers. Experts warn of unreported breaches due to lax regulations.