The easiest way, from a technical perspective, is some kind of inside job - e.g. plant a new hire a company and they then have access to some systems, and they can build from there.
The second, from a technical perspective, is social engineering where they contact existing employees with what they think are legitimate security request/changes and can get access details that way. Alternatively if they can get physical access to a system - by pretending to be contractors, cleaning staff, etc. then they can do things from there.
From a purely remote hacking technical perspective websites or sites of any description have to interact with legitimate users - or they aren't a 'site ' hackers write programs that interact with the sites in ways that can allow them to run programs or commands on the 'back end'. All systems have vulnerabilities - generally the older they are the more vulnerable they are.
All hackers need is a 'foothold' then they can wait weeks/months/years if needs be for the opportunity to slowly increase access until they have what they want. Some will never 'announce their presence' and just sit there stealing data for years.