public information about Poland’s water sector shows how fragile passwords and poorly protected industrial controllers can turn a routine access problem into a critical-infrastructure risk.