I'm pretty familiar with the Panama Papers, but didn't know much about the underlying exfiltration. Luckily, Wired did an expose of Mossack Fonseca's security

I'm pretty familiar with the Panama Papers, but didn't know much about the underlying exfiltration. Luckily, Wired did an expose of Mossack Fonseca's security lapses in 2018, and yeah, wow – if any of this is evidence of their broader security patterns at the time of the breach, you definitely would not have needed a team of Fancy Bear hackers to pull this one off: > Mossack Fonseca has failed to update its Outlook Web Access login since 2009 > Mossack Fonseca's client portal is also vulnerable to the DROWN attack... The portal, which runs on the Drupal open source CMS, was last updated in August 2013 > The version of Drupal used by the portal has at least 25 vulnerabilities, including a high-risk SQL injection vulnerability that allows anyone to remotely execute arbitrary commands. Areas of the portal's backend can also be accessed by guessing the URL structure > Mossack Fonseca's emails were also not encrypted [and] the company did not use the TLS security protocol https://www.wired.co.uk/article/panama-papers-mossack-fonseca-website-security-problems https://www.wired.co.uk/article/panama-papers-mossack-fonsec... That all being said, of course none of this means it wasn't a nation state! It definitely could have been – the incentives were certainly there. But to call it "obviously" the job of state-employed hackers seems wrong.