Hacking these days is really easy. Basically, if someone has the time and resources, they can gain access to anything that they wish. So the goal of someone trying to protect a particular asset is to assume someone is trying to get access to it already and to essentially make it too time intensive and expensive for them to gain access. If it would take you $1M to build a rig to brute force my password in 90 days time... ill change them every 60 days. And when you can build these rigs for less, ill increse my password complexity.
But honestly, most hackers these days arent doing crazy sophisticated shyt to get into these companies you see on the news. Literally, like in the mr robot episode, i drop a usb drive in the lobby, and wait for someone to stick it into a computer. Or, i look at the open jobs, find the email for the hiring manager, then i send them a word resume with a marco embeded. They open it, and i own their computer. shyt, i might pay for malware on a local pizza shops website and wait for employees to hit that. There are just so many ways that dont involve some sophisticated hacking technique these days. Its crazy.