At least a dozen states have reported cyberattacks on their water systems, starting with Minnesota in late July. But other kinds of infrastructure – like hospitals or the energy sector – are also vulnerable, said Nikita Shah, senior fellow at the Center for Strategic and International Studies.