The American Water cyberattack: Explaining how it happened