When hackers penetrated a small water utility in North Carolina three years ago that debilitated its IT systems, operators there refused to “bow” to hackers and fork over ransom money to make the assault stop.

That 2018 cyberattack was part of what experts say is a fast-growing and evolving threat in the water sector and a glaring example of the type of attack — ransomware — that earlier this month shut down the East Coast’s largest fuel supplier, the Colonial pipeline.