> series: anatomy_of_a_breach —— part: 087 —— target: mossack_fonseca —— documents: 11,500,000 —— size: 2.6TB<span class="cursor-blink">_</span>_
On 3 April 2016, the International Consortium of Investigative Journalists (ICIJ) and over 100 media organisations worldwide simultaneously published stories based on the Panama Papers — 11.5 million documents (2.6 terabytes) leaked from Mossack Fonseca, a Panamanian law firm specialising in offshore company formation. The documents exposed the offshore financial structures of 12 current and former world leaders, 128 politicians and public officials, and thousands of wealthy individuals — revealing how offshore entities were used for tax avoidance, evasion, and money laundering.
The political consequences were immediate: Iceland's Prime Minister resigned, investigations were launched in dozens of countries, and the global offshore finance industry faced unprecedented scrutiny. But from a cybersecurity perspective, the more revealing story was how the leak occurred. Security researchers who analysed Mossack Fonseca's infrastructure found a catalogue of basic security failures: an outdated WordPress installation (version 4.1, with at least 25 known vulnerabilities), an unpatched Drupal portal for client document access, an email server running on the same network without encryption, and no evidence of security monitoring or testing.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe Panama Papers had catastrophic consequences for Mossack Fonseca's clients — not because of anything the clients did wrong, but because their law firm failed to implement basic security controls. For UK law firms, professional services firms, and any organisation that holds clients' confidential data, the lesson is unambiguous: your clients' security depends on your security. If your firm is breached, your clients are exposed.
Our web application testing and infrastructure testing identify the vulnerabilities that Mossack Fonseca's systems contained. Cyber Essentials certification provides the baseline and demonstrates security investment to clients and regulators. SOC in a Box for Legal Services provides continuous monitoring. And UK Cyber Defence provides incident response when confidential data is at risk.
Our <a href="/penetration-testing/web-application">web application testing</a> finds the unpatched CMS. <a href="/blog/sector-under-the-microscope-legal">Our legal sector analysis</a> examines the threat landscape. <a href="https://www.socinabox.co.uk/sectors/solicitors">SOC in a Box for Legal</a> monitors 24/7.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call