Very easy if they find vulnerabilities to exploit. Usually, it takes almost four steps to access your systems.