Poor security left hackers inside water company network for nearly two years