Mossack Fonseca -- simple explanation

What we know is that they have had websites unpatched for years on the same network as their email server. What's more likely:

- Mossack Fonseca while being completely incompetent in patching their websites have actually built and maintained an internal network where the servers trusted each other more than external traffic

- They simply didn't patch their email server as well and someone just broke into that directly.