Another story here is how did it leak?

It's interesting to observe that Mossack Fonseca's client portal login uses @#&@!&*! wordpress.

I have no knowledge of how it leaked but it's amazing to me that a firm responsible for trillions of dollars uses wordpress on its client login site.