Answer:
cookies are stored on client side.
A hacker would need access to your computer, either by physically reading the cookie data or by means of cross-site scripting.
Other than that, cookies should not contain passwords or credit card numbers, just things like preferences or session identifiers.