Apparently a lot. 90% of all Cyber Attacks start with a phishing email.
Besides the social engineering side of a phishing email that gets an employee to share sensitive information or carry out an ill-intented action, the email by itself can carry links and files that can harm a system by letting uninvited guests into your computer or network.
Though Operating Systems and Browsers have come a long way in protecting its users, a harmless looking link can spell “Doom” by shutting down entire networks, exposing private information, cutting off fuel supply to an entire coast or even sabotaging nuclear facilities.