Instead of poisoning the water supply, you'd stuxnet the pumps. I imagine the network interfaces for status and control are about as well protected as grocery store freezers.

A bad pathogen could go world wide, but you could trash multiple cities with online attacks. No electricity, no water, no communications. Things would get bad.