MitM attacks ever actually happen on a trusted network?

Has anyone actually witnessed a Man-in-the-Middle attack on their LAN?

Our security team is worried about certain systems that I manage that have vulnerabilities for MitM. (though they are old, only option is to replace)

I'm just wondering how often this actually happens in the real world. I know it's theoretically possible if you aren't following endpoint security best practices.

But realistically, how often does someone break into your datacenter and then setup MitM?

I guess adding the office LAN, outside the datacenter increases this risk significantly. WiFi, increasing it even more.

Over the internet, sure, I'm certainly worried about it.