They have been, eg, it's a common scam to steal someone's phone and text their friends asking for money, or to hack into someone's work email and try to get a fraudulent invoice approved. I read an article about an incident of the latter once where they compromised the CEO's email, read through it enough to passably imitate his writing style, and then sent an invoice to the CFO which they described as urgent.