A cyberattack on water systems in a dozen states is exposing years of under-investment in critical infrastructure and how US adversaries can threaten services that everyday Americans take for granted, according to industry experts and current and former US officials.