All of this data was leaked through a WordPress plugin uploaded to an old installation; WordPress is one of the easiest platforms to secure (IMO) so can't understand why organisations can't take the short amount of time needed to secure it.