They could redirect traffic, so it goes through the attacker's computer, with personal data potentially being captured and examined, before going out to the internet. Or it could change other policies ...