Louvre heist: Museum’s security password was “LOUVRE”; probe reveals major cybersecurity lapse

Paris: Weeks after a daring $102 million (approximately ₹900 crore) daylight robbery at the Louvre Museum, investigators have uncovered an astonishing lapse in the institution’s cybersecurity — its main security system was protected by the easily guessed password “LOUVRE.”

According to a new report, France’s National Cybersecurity Agency (ANSSI) discovered the weakness while investigating the 19 October heist. Confidential documents obtained by Libération revealed that the agency had previously accessed the museum’s video surveillance servers using the same password during an earlier inspection. The vulnerability was first identified in a 2014 audit, which warned of “serious shortcomings” in the museum’s digital defences.

That audit also found that the Louvre was relying on software more than two decades old to manage critical protection and detection systems. “An attacker who manages to take control of it would be able to facilitate damage or even theft of artworks,” ANSSI cautioned at the time. It remains unclear whether the museum changed the password or upgraded its systems following those warnings.

The recent heist unfolded in broad daylight, when a four-member gang, disguised in construction vests and motorcycle helmets, used a cherry picker to reach the museum’s Apollo Gallery. In a meticulously executed operation lasting just seven minutes, they smashed display cases with chainsaws and stole eight priceless jewels, including a sapphire diadem, necklace, and a single earring that once belonged to 19th-century queens Marie-Amélie and Hortense.

The thieves then descended using the same cherry picker, attempted to set it on fire, and escaped on two waiting scooters. French authorities have since arrested four suspects, three of whom are believed to have taken part in the robbery. Investigators say the men were known to police for previous thefts and may have acted on commission.

France’s Culture Minister Rachida Dati has announced that the Louvre will install new anti-ramming and anti-intrusion barriers by the end of the year. Louvre Director Laurence des Cars admitted that the museum’s surveillance cameras failed to adequately cover the entry point used by the robbers — with the only nearby camera facing away from the balcony they accessed.

While Dati confirmed that the museum’s internal security systems functioned during the heist, she acknowledged “major flaws” in the Louvre’s external protection and monitoring.