The situation recalls the BPAS hack in 2012. Similar factors: an unknown CMS which was found to be years out of date, no security hardening despite being a public target, and an organisation using what was supposed to be a public-facing informational web site to store confidential client information. A further factor was high staff churn (e.g. there was no one working in the organisation who had been there when the web site was built) which meant no one had any idea that their data breach nightmare was building up. After the hack, BPAS received a £200,000 data protection fine on the grounds that their ignorance of their security loopholes was no excuse. Mossack Fonseca will get about as much sympathy from any Panamanian data regulators. Ultimately they hung themselves with their own rope.

Contrast Mossack Fonseca being too lazy to update a theme, with the security precautions used by the consortium of journalists who worked on the story. http://www.wired.co.uk/news/archive/2016-04/04/panama-papers-data-leak-how-analysed-amount