The astonishing leak of “Panama Papers”, the documents owned by a Panamanian law firm Mossack Fonseca has quaked the world- from the viewpoints of politics, economics and technology. While the exact reason behind the breach is not yet proven, but the security experts have already pointed out some possible risk factors that led to the gigantic leak.  

What are some of the major points we can draw from the total incident? Let’s see.

Biggest in the History

The Panama Papers leak is the largest data breach in the history. It published a whopping 2.6 terabytes of data scored by 11 million documents. Previous leaks were in gigabytes scale, for example 230 GB (Sony Pictures) and 30 GB ( Ashley Madison).

Mossack Fonseca had outdated CMSes, backdated plugin and unencrypted & old email server!

Backdated WordPress & Drupal

Mossack Fonseca runs two main websites using old versions of two popular CMSes. One is the front facing site another is the customer access portal. The front facing site used WordPress which had at least 3 months old version that means many known vulnerabilities might have contributed to the attack. The customer portal ran an outdated version of Drupal. Both cases are enough to attract an attacker!

Outdated Slider Revolution Plugin

Wordfence, the familiar WordPress security company says in a blog post that Mossack Fonseca site uses a slider plugin called Slider Revolution, which is also outdated and vulnerable to attacks. The plugin was not updated even when the post was live. However, Wordfence has noticed the law firm about the issue.

Unencrypted and Outdated Email Server

According to media reports, Mossack Fonseca’s email server used an outdated version of Microsoft’s Outlook Web Access. The email system was hosted at the same IP as the WP server. So the hackers might have gained access to the web server by compromising the website and then downloaded emails from the email server. It’s being suspected.

If you own or manage a website, make sure to keep the every single element (CMS, themes, plugins etc.) updated. Use firewall and proxy server/security CDN services like CloudFlare, Incapsula etc.

Mossack Fonseca had outdated CMSes, backdated plugin, and unencrypted & old email server, apparently which may have played a vital role together in the hack. What does it mean to you? Let me make it clear. If you own or manage a website, make sure to keep the every single element (CMS, themes, plugins etc.) updated. Take regular backups and use firewall and proxy server/security CDN services like CloudFlare, Incapsula etc. To learn about some top WordPress security plugins, please see this post.