Louvre jewel heist exposes security flaws and delayed upgrades

On Oct. 19, a group of thieves carried out a daylight raid on the Louvre Museum’s Apollo Gallery in Paris, stealing a trove of crown jewels valued at about 102 million euros in an operation that lasted under seven minutes, investigators said. The suspects used a truck-mounted lift to reach a second-floor window, forced entry with power tools around 9 a.m., cut display cases and fled on scooters. The jewels remain missing and an active criminal investigation is underway.

Follow-up inquiries and confidential audit documents have exposed significant weaknesses in the museum’s security and information systems. Engineers from France’s National Cybersecurity Agency found in a 2014 audit that a server managing the Louvre’s video surveillance could be accessed with the password LOUVRE. Subsequent reviews flagged other issues, including the use of manufacturer default credentials for some systems and legacy software that dates back two decades. The court of auditors said plans to modernize security had been repeatedly delayed and that technical upgrades scheduled since 2018 had not been implemented.

Laurence des Cars, president and director of the Louvre, told a Senate committee that the...