on May 9, 2016 of a searchable database containing information on over 200,000 offshore entities implicated in the Panama Papers investigation and more than 100,000 additional companies implicated in the 2013 Offshore Leaks investigation. Mossack Fonseca asked the ICIJ not to publish the leaked documents from its database. "We have sent a cease and desist letter," the company said in a statement. The sheer quantity of leaked data greatly exceeds the WikiLeaks Cablegate leak in 2010 (1.7 GB), Offshore Leaks in 2013 (260 GB), the 2014 Lux Leaks (4 GB), and the 3.3 GB Swiss Leaks of 2015. For comparison, the 2.6 TB of the Panama Papers equals approximately 2,660 GB. Data security Mossack Fonseca notified its clients on April 1, 2016, that it had sustained an email hack. Mossack Fonseca also told news sources that the company had been hacked and always operated within the law. Data security experts noted, however, that the company had not been encrypting its emails and furthermore seemed to have been running a three-year-old version of Drupal with several known vulnerabilities. According to James Sanders of TechRepublic, Drupal ran on the Apache 2.2.15 version from March 6, 2010, and worse, the Oracle fork of Apache, which by default allows users to view directory structure. The network architecture was also inherently insecure; the email and web servers were not segmented from the client database in any way. Some reports also suggest that some parts of the site may have been running WordPress with an out-of-date version of Slider Revolution, a plugin whose previously-announced vulnerabilities are well-documented. A grey hat hacker named 1×0123 announced April 12 that Mossack Fonseca's content management system had not been secured from SQL injection, a well-known database attack vector, and that he had been able to access the customer database because of this. Computer security expert Chris Kubecka announced May 24, 2016, that the Mossack Fonseca client login portal was running four different government grade remote access trojans (RATs). Kubecka confirmed there were still numerous critical vulnerabilities, too many open ports into their infrastructure and internet access to their archive server due to weak security. Kubecka explained how each data security issue was discovered in detail in a book titled Down the Rabbit Hole: An OSINT Journey. Leak and leak journalism Gerard Ryle, director of the ICIJ, called the leak "probably the biggest blow the offshore world has ever taken because