I've encountered very little software that does not fairly frequently require (security) updates. It's somewhat irrelevant whether the leak happened through an

I've encountered very little software that does not fairly frequently require (security) updates. It's somewhat irrelevant whether the leak happened through an unpatched security issue in Drupal since they're apparently running the vulnerable version today and the update has been released way back in 2014. The real reason that lead to this is the strategy of running security updates to a public-facing website containing sensitive materials with the frequency of only once every 1-2 years, or worse. Assuming of course that this website is the source of these leaks at all.