In early 2015, an anonymous source contacted the Süddeutsche Zeitung, a German newspaper, with a question: “Interested in data?” What followed was the largest leak of confidential documents in history — 11.5 million files, 2.6 terabytes of data, spanning nearly 40 years of records from a Panamanian law firm called Mossack Fonseca. The firm had created more than 214,000 offshore shell companies for clients in over 200 countries and territories. The documents — emails, financial spreadsheets, passports, corporate records — revealed the secret owners of bank accounts and companies across 21 offshore jurisdictions, from the British Virgin Islands to Nevada. The International Consortium of Investigative Journalists coordinated 370 reporters from 76 countries to analyze the files over the course of a year before publishing on April 3, 2016. The resulting investigation identified 12 current and former heads of state, 128 politicians and public officials, and an ecosystem of drug traffickers, arms dealers, tax evaders, sanctions violators, and financial fraudsters — all served by a single law firm operating out of Panama City with offices in more than 35 countries. Two journalists who investigated the Panama Papers — Daphne Caruana Galizia in Malta and Ján Kuciak in Slovakia — were subsequently murdered.
The firm
Mossack Fonseca was founded in 1977 by Jürgen Mossack, a German-born lawyer whose father had served in the Waffen-SS before emigrating to Panama, and Ramón Fonseca, a Panamanian novelist and politician who would later serve as an adviser to Panama’s president. The firm grew into one of the world’s largest creators of shell companies — corporate structures designed to separate the legal ownership of assets from their beneficial owners, allowing individuals to hold bank accounts, real estate, yachts, art collections, and entire business operations without their names appearing on any public record.
The business model was straightforward. Mossack Fonseca rarely dealt with the individuals who ultimately benefited from its services. It worked through intermediaries — banks, law firms, and accounting firms — who hired Mossack Fonseca to set up shell companies for their wealthy clients. The intermediary structure provided two layers of deniability: the client’s name was hidden behind the shell company, and Mossack Fonseca could claim it didn’t know who the client was because it only dealt with the intermediary. Hundreds of banks and their subsidiaries registered nearly 15,600 shell companies through the firm. The leaked records show that Mossack Fonseca worked with global institutions including HSBC, UBS, and Credit Suisse.
Fonseca’s public defense of the firm was that it was like a car factory — responsible for building the car, not for what the driver does with it. The leaked files told a different story. The firm regularly offered to backdate documents to give clients financial advantages. Internal emails from 2007 show employees discussing a price structure for backdating — $8.75 per month of falsified dating. In Nevada, when the firm faced a U.S. legal action, employees removed paper records from the Las Vegas branch and wiped electronic records from phones and computers. The firm’s client roster, as documented in the leaked files, included suspected financiers of terrorism, nuclear weapons proliferators, and gunrunners. The car factory knew what the cars were being used for.
What the leak revealed
The Panama Papers documented what the Shadowcraft course teaches as a structural principle: the offshore financial system is not a collection of isolated tax havens. It is an integrated global infrastructure — staffed by lawyers, bankers, and accountants at reputable institutions — that exists to separate wealth from accountability. The specific revelations included:
Associates of Russian President Vladimir Putin had shuffled as much as $2 billion through banks and shadow companies connected to Mossack Fonseca entities. The money moved through a network of offshore structures whose beneficial ownership traced back to individuals in Putin’s inner circle, including a cellist who was one of Putin’s closest friends.
Iceland’s Prime Minister Sigmundur Davíð Gunnlaugsson resigned after the investigation revealed he and his wife had secretly held nearly $4 million in bonds in Icelandic banks through an offshore company — even as his government was negotiating with those banks’ creditors after the 2008 financial crisis. He had a direct financial interest in the outcome of negotiations he was conducting on behalf of the public.
Pakistan’s Prime Minister Nawaz Sharif resigned in 2017 after Pakistan’s Supreme Court disqualified him from office following revelations that his children had used shell companies to hold multi-million-dollar London real estate.
In Malta, the Panama Papers revealed that the Minister for Energy and the Prime Minister’s Chief of Staff held secret companies in Panama and trusts in New Zealand — structures designed to conceal assets. The journalist who exposed this, Daphne Caruana Galizia, was killed by a car bomb on October 16, 2017. Malta’s Prime Minister had defended the officials she was investigating and kept them in government even after the Panama Papers confirmed the existence of their offshore structures. Separately, Slovak investigative journalist Ján Kuciak, who was also investigating connections revealed in the Panama Papers, was murdered along with his fiancée in February 2018.
What didn’t change
The Panama Papers generated massive media coverage, forced the resignation of multiple heads of state, triggered criminal investigations across dozens of countries, and led to Mossack Fonseca’s closure in 2018. But the infrastructure the firm serviced — the network of offshore jurisdictions, intermediary banks, law firms, and accounting practices that create and maintain shell companies — survived the leak entirely intact. Mossack Fonseca was the fourth-largest provider of offshore services in the world. The top three continued operating. The British Virgin Islands, where Mossack Fonseca couldn’t identify the owners of more than 70 percent of its 28,500 active companies at the time of the leak, remains one of the world’s busiest offshore incorporation jurisdictions. Panama, where the firm couldn’t identify owners of 75 percent of 10,500 active shell companies, remains a global hub for corporate secrecy.
The Panama Papers revealed the plumbing. They didn’t turn off the water. The anonymous source — the whistleblower whose identity remains unknown — stated publicly that the murders of Caruana Galizia and Kuciak had deeply affected them and called on the European Union to deliver justice. As of 2026, criminal proceedings related to the Malta revelations are still ongoing.
Why it’s in Shadowcraft
Every other Shadowcraft case study involves a single institution — a bank, a front company, a chartered corporation, a secret lodge, an intelligence alliance. Mossack Fonseca is the case study that shows the system those institutions operate within. The shell companies that Marc Rich used to trade with sanctioned regimes, the offshore entities that Banco Ambrosiano used to channel $1.3 billion through the Vatican Bank, the front companies that KoKo registered across the West, the sanctions evasion architectures that Russia’s shadow fleet uses today — all of them require the same underlying infrastructure: a jurisdiction that allows anonymous incorporation, a law firm that creates the entities, a bank that opens the accounts, and an intermediary structure that ensures no single participant has to acknowledge what the system is being used for.
Mossack Fonseca created 214,000 shell companies. Two journalists were killed for investigating what those companies concealed. The firm closed. The system that made it possible didn’t.
We cover Mossack Fonseca alongside Wagner Group, Crypto AG, China Poly Group, and 20 other case studies of covert institutional power across our Shadowcraft course — where the Panama Papers are the X-ray that reveals the skeletal system every other case study runs on.