Early in 2015 a reporter at the Süddeutsche Zeitung, Bastian Obermayer, received a message from a stranger: "Hello. This is John Doe. Interested in data?" The sender set terms — encrypted channels only, no meeting, ever — and said that exposure would cost him his life. The data came in instalments until it reached 2.6 terabytes: 11.5 million files from Mossack Fonseca, a Panamanian law firm that had spent nearly four decades incorporating anonymous companies, more than 210,000 of them, for clients who preferred not to be named. The newspaper took the files to the International Consortium of Investigative Journalists, which put some 370 reporters in 76 countries to work on them in secret for about a year. At 2 p.m. Washington time on 3 April 2016, they published together.
The files named twelve current or former world leaders, and the first to fall was in Reykjavik. Sigmundur Davíð Gunnlaugsson, Iceland's prime minister, had been recorded weeks earlier by Swedish television being asked about Wintris, a British Virgin Islands company he had co-owned with his wife, which held bonds in the collapsed Icelandic banks, never publicly declared; he stood up and walked out, and the footage aired on 3 April. The next evening a crowd filled the square outside the Althing. On 5 April he said he would step down — his office spent the following day arguing over the word — and his agriculture minister, Sigurður Ingi Jóhannsson, took over. Pakistan's Sharif family and associates of Vladimir Putin were in the same files; their reckonings took longer.
For this magazine the question was how the files left. Co-founder Ramón Fonseca told Reuters that week that the firm had been hacked from abroad, that an inside job was ruled out and that prosecutors had been told; they raided its headquarters on 12 April. Forbes reported on 5 April that the client portal ran Drupal 7.23, a 2013 release with at least 25 known vulnerabilities, and the public website a version of WordPress months out of date; Wired UK found an Outlook Web Access login unchanged since 2009; Wordfence, a WordPress security firm, pointed to an unpatched Revolution Slider plugin that could give an attacker a shell on a server sharing an address with the firm's mail; and that mail, Forbes noted, citing an American Civil Liberties Union technologist, travelled unencrypted.
None of it proved how the leak happened, and nothing since has; the source has never been identified. On 6 May John Doe published a manifesto, The Revolution Will Be Digitized, denying that he had ever worked for a government and offering to help prosecutors. The reporting won a Pulitzer Prize in April 2017. Pakistan's Supreme Court disqualified Nawaz Sharif from office on 28 July 2017. Mossack Fonseca announced on 14 March 2018 that it was closing. When Panama tried its founders and 26 others for money laundering, a judge acquitted all 28 on 28 June 2024, ruling that evidence taken from the firm's servers had not been gathered with due process; Ramón Fonseca had died the month before. Governments, by ICIJ's count, had by then recovered around $1.4 billion.
Whole countries in a torrent file
Two national registries were dumped within a fortnight. On 3 April a website offered 49,611,709 records from Turkey's civil registry — names, identity numbers, birth dates, addresses — in 6.6 gigabytes beneath a taunt at the government; the Associated Press tested ten unpublished identity numbers against it and matched eight. Ankara's communications minister called it old data, astray since about 2010, and prosecutors opened an inquiry. The Philippines followed. Anonymous Philippines had defaced its election commission's website on 27 March, and LulzSec Pilipinas had posted links to what it called the whole voter database. On 6 April Trend Micro read the files: some 55 million registered voters, passport details for 1.3 million overseas voters and 15.8 million fingerprint records — possibly, it wrote, among the largest government breaches anywhere. On 21 April a site called wehaveyourdata made the records searchable by name, claiming 70 million entries, more than the electorate; it was gone within a day. Two young men were arrested, and voting went ahead on 9 May. On 28 December the National Privacy Commission found the commission in breach of the Data Privacy Act and recommended prosecuting its chairman for gross negligence.
Malware inside the bank's own messenger
Since the end of February the world had known that fraudulent SWIFT instructions had moved $101 million out of Bangladesh Bank's account at the New York Fed on 4–5 February, and that $81 million of it had vanished into Manila; how remained unclear. On 25 April it became a malware story. Sergei Shevchenko of BAE Systems published an analysis of custom code written for SWIFT's Alliance Access client software: it bypassed a validity check in the software, deleted chosen transactions from the local database, altered balance reports and doctored the confirmations sent to the bank's printer. It was built to run until 6 a.m. on 6 February, the morning after the money moved. SWIFT acknowledged the same day that malware was targeting its client software, issued a software update and a warning, and stressed that its own network had not been breached. The month closed on Cryptome, where a 1.4-gigabyte archive attributed to Qatar National Bank appeared on 26 April in folders labelled Al Jazeera, Al Thani and Spy, claimed in a video by a Turkish-linked group calling itself Bozkurtlar; QNB said on 26 April that there was no financial impact on its clients or the bank, and on 1 May that while some of the released data might be accurate, much of it had been constructed from other, non-QNB sources.
Five hundred names, a billion locked messages
The Indian Express was the ICIJ's partner in India, and its front page of 4 April carried the country's share: about 500 Indians with offshore companies or trusts through Mossack Fonseca, among them the property developer K.P. Singh and the actors Amitabh Bachchan and Aishwarya Rai Bachchan. Several said their holdings were lawful, or that they knew nothing of the companies. The government moved the same day: on the prime minister's instruction, Finance Minister Arun Jaitley announced a multi-agency group of the Central Board of Direct Taxes, the Financial Intelligence Unit, the board's foreign-tax division and the Reserve Bank, promising action against any account found unlawful. The group outlived its occasion, taking on the Paradise Papers in 2017 and the Pandora Papers in 2021; by December 2021 the finance ministry was reporting ₹20,353 crore in undisclosed credits among 930 India-linked entities from the first two leaks, and criminal prosecution complaints filed in 52 cases under the black-money law.
The month's other Indian story was a software update. On 5 April WhatsApp switched on end-to-end encryption for its billion users, built on the Signal Protocol, and nowhere did that matter more than in India, already its largest market. The country had no settled law on the question — a draft encryption policy had been withdrawn within a day the previous September — and what it got instead was a petitioner: Sudhir Yadav, a right-to-information activist, asked the Supreme Court to ban WhatsApp and its rivals on national-security grounds, and on 29 June the court declined to hear him. The argument returned as the 2021 traceability rule, which WhatsApp challenged in the Delhi High Court, and runs beneath the DPDP Act of 2023, which left encryption alone.
Nvidia's box, Facebook's bots, DeepMind's records
On 5 April 2016, at its GPU Technology Conference, Nvidia unveiled the Tesla P100, its first Pascal chip, and the DGX-1, eight of them in a $129,000 box that Jensen Huang said did the work of 250 servers; he hand-delivered the first to OpenAI in August. On 12 April Facebook opened Messenger, and its 900 million monthly users, to bots built on Wit.ai technology it had bought, 1-800-Flowers and CNN among the first. On 27 April OpenAI made its first public release, Gym, a beta of environments from Atari games to simulated robots for reinforcement-learning research; archived in April 2026, it lives on as the Farama Foundation's Gymnasium. On 29 April New Scientist revealed DeepMind had access to records on 1.6 million patients at three London hospitals run by the Royal Free trust, HIV status and abortions included, for a kidney-injury app. The trust said the data was for direct clinical care only; Google said it had no commercial plans. On 3 July 2017 the Information Commissioner ruled the trust had breached the Data Protection Act.
Symantec loses its chief, ransomware its keys
On 28 April 2016 Symantec said Michael Brown would step down as chief executive once a successor was found, and the same day cut its forecast for the quarter just ended to $873 million from $885–915 million, blaming a faster-than-expected shift among enterprise customers to subscriptions; Ajei Gopal, once its chief technology officer, arrived from Silver Lake as interim president, and the search ended in June with the purchase of Blue Coat. The rest of the month belonged to free decryptors. On 10 April a researcher known as leostone put up a site whose genetic algorithm recovered Petya's key in seconds from two sectors of an infected disk; Jigsaw, reported on 11 April, deleted a file an hour until $150 was paid and was broken the same day; and CryptXXX, found by Proofpoint in mid-April demanding about $500, had a Kaspersky decryptor by 26 April. Its authors answered with version 2.0 in early May, Kaspersky replied on 13 May, and version 3.0 shut the tool out on 21 May — an arms race the decade would run at scale.
⏳ Time capsule — April 2016
- On 3 April at Eden Gardens in Kolkata, West Indies won the World Twenty20 final, Carlos Brathwaite hitting Ben Stokes for four consecutive sixes to score the 19 runs England had left them for the last over.
- Kobe Bryant played his final NBA game on 13 April, scoring 60 points against the Utah Jazz at the age of 37 to close twenty seasons with the Los Angeles Lakers.
- Prince died on 21 April at Paisley Park, his studio complex outside Minneapolis, at 57; the medical examiner later found an accidental overdose of fentanyl.
- On 22 April, Earth Day, 175 parties signed the Paris climate agreement at the United Nations in New York — the most ever to sign an international agreement on its opening day — and fifteen states deposited their ratifications the same afternoon.
A leak, not a breach
Ten years on, the distinction this edition insisted on has held. The Panama Papers were never sold, ransomed or dumped; they were handed to reporters, who published a database of the companies and not the documents, so that most of the 11.5 million files remain unpublished. The pattern repeated — 13.4 million files from Appleby as the Paradise Papers in November 2017, 11.9 million more as the Pandora Papers in October 2021 — and the security lesson repeated with it: firms whose product was discretion had not patched for it. Mossack Fonseca's closure in March 2018, the Panama acquittals of June 2024 and the $1.86 billion that tax agencies had told ICIJ by 2025 they had recovered make an untidy ledger. The one line that has never been filled in is the source's name.
The rest of the month reads as first drafts. The Turkish and Philippine registries were early entries in the whole-population dump, a genre that by September 2019 could put a record for nearly every Ecuadorian on one open server. The BAE analysis of 25 April opened a SWIFT chapter that ran through Vietnam, Ecuador and Taiwan and closed in September 2018 with an American charge sheet naming a North Korean programmer. Two events this edition could only glance at became the year's story: the GRU officers who, according to the 2018 indictment, were inside the Democratic Congressional Campaign Committee by mid-April and the DNC by the 18th — the story of June — and the billion WhatsApp accounts that went dark to everyone but their owners, which Indian governments have negotiated with since.