A reported intrusion into a network used by a critical-infrastructure operator shows how ordinary login details can become strategic access in the wrong hands.