Earlier I posted this answer:
I claimed it was a bit unrealistic... well, here's the details...
(I thought about editing my earlier answer, but I'm going to go into way more detail here... best to start with a clean slate so the comments aren't confusing.)
I will mark certain words in boldface. Those are the points of this description that are particularly relevant to answering this question.
This is computer. It is a ruggedized cRIO-9032 from National Instruments (specs here):
It is designed for outdoor use, primarily as a monitoring and control system for things like stress on bridges, gates on dams, stability of volcanoes, etc. It is wi-fi enabled, and operates in environments ranging between −20 °C and 55 °C. The chassis is aluminum A.
Now... you see those four rectangles on the right side of the image? Those are cRIO modules — think like a card on the inside of desktop machines, but these add various external connections for sensors and whatnot. Here's a closer view of one module:
R&D testing confirms that you can destroy one or more of those modules — as long as the backplane isn't pierced, the computer will continue running just fine. The next time that the computer tries to access that module, it will raise a "module not found" error (error code −65622). The backplane is pretty easy to miss — an arrow vertical through a module won't hit it.
Now... I said this is a computer. A user programs it with whatever software they want, running on the real-time operating system. A brand new cRIO has "admin" and blank password as its default setting. Users are responsible for configuring a better password.
What does all this mean?
- It means you have a computer that is frequently deployed in outdoor locations where it makes sense to shoot an arrow (unlike a server room).
- You have a system with that will continue operating if a part gets destroyed.
- And you have it programmable to be as secure or unsecure as the software engineers who work on the project choose to make it.
So now the scenario goes like this:
A team of software engineers creates some sort of monitoring system. They're pressed for time, and they know that they're going to have to debug the system later in the field, so they leave their debug backdoor in the software — it's off by default, but if one of the modules turns out to be buggy, the wi-fi will open an unsecure port so a laptop can log in an provide instructions. They aren't worried about security because, well, let's face it, few software engineers are, but this team figures they're out in the boonies, monitoring an oil rig or something. What they forget is that this device, in order to upload its regular monitoring data, has login certificates for databases that should probably be on an air-gapped system away from anything sensitive, but probably aren't because, again, no one worries about security. So instead, those databases are hosted on server X.
So your hacker needs to get into server X and learns about this remote monitoring project. The cRIO is high up on the oil derrick. And the hacker has one of those nifty arrows from Hawkeye of Marvel Comics. This particular arrow has a payload behind it of something like a Raspberry Pi or similar device, nicely form-factored for aerodynamic flight. (Don't complain about the handwave — I got the answer to this point... you're on your own for arrow design!)
He/she goes out to the site, fires his arrow with its electronic payload through one of the sensor modules. The cRIO raises the error code, and the silly developers' debug code turns on the wi-fi. The arrow logs in and uploads new instructions, takes advantage of security certificate for server X. He/she then goes home to his 7-monitor desktop system for some serious hacking. (Please don't do this in your movie. Stupid Swordfish.)
Important: If you ever make a movie using this idea, my co-workers are very intrigued and want to be notified!