American Water rinsed in cyberattack, turns off app