Attackers remotely accessed industrial controllers at water systems in seven states. The campaign suggests a common weakness utilities everywhere should address, experts warn.