Mossack Fonseca notified its clients on April 1, 2016 that it had sustained an email hack.
Data security experts noted, however, that the company had not been encrypting its emails[REF] and furthermore seemed to have been running a three-year-old version of Drupal with several known vulnerabilities [REF].