Some Intel boxes have a Management Engine which can boot a powered-off machine remotely and take complete control. Wireless connected machines can be attacked

Some Intel boxes have a Management Engine which can boot a powered-off machine remotely and take complete control. Wireless connected machines can be attacked using skip-level packets. Some ethernet interfaces have controller boards that can be hijacked remotely. If you're using a bluetooth keyboard it can be attacked remotely. MS boxes have a dozen ways they can be attacked (e.g the remote management console, the printer, the shared folders, etc). Here's the universal law: If the CPU can get at it, then anyone can get at it. If you want reasonably secure records (e.g. employee data) then ONLY ever record that information on paper and keep it in a locked room. Oh, and don't use the copier because the copiers have hard drives that store image data.