really depends on the skill, time, and incompetence of the target(s).
could go from guessing hisemail@whatever.com with his password and finding out whatever to an elaborate scheme of manipulating the route data takes and decrypting it and social engineering someone close to him for sensitive information.
could go from guessing hisemail@whatever.com with his password and finding out whatever to an elaborate scheme of manipulating the route data takes and decrypting it and social engineering someone close to him for sensitive information.