Louvre Museum's Security Password During 900-Crore Heist Was "LOUVRE"

Weeks after a daring $102 million daylight robbery in the Louvre Museum in Paris, investigators have uncovered a stunning flaw in the institution's digital defences. The institution's core security system was protected by the easily guessed password “LOUVRE,” according to a new report.

France's National Cybersecurity Agency (ANSSI) discovered the weakness during its investigation into the October 19 heist. Confidential documents obtained by outlet Liberation revealed that the agency had previously accessed the museum's video surveillance servers using the same basic password. The vulnerability was first flagged in a 2014 audit.

That audit found “serious shortcomings” in the museum's cybersecurity, including reliance on two-decade-old software to manage its most critical protection and detection systems. “An attacker who manages to take control of it would be able to facilitate damage or even theft of artworks,” the agency wrote at the time.

It remains unclear whether the Louvre changed the password or updated its systems following the warnings.

The high-profile heist went down in broad daylight as a four-man crew, dressed in construction vests and motorcycle helmets, used a cherry picker to reach the museum's Apollo Gallery.

In seven minutes, they smashed glass display cases with chainsaws and made off with eight priceless gems, including a sapphire diadem, necklace, and single earring once belonging to 19th-century Queens Marie-Amelie and Hortense.

The thieves then went down using the same cherry picker, attempted to torch the vehicle, and fled on two scooters parked nearby. 

French authorities have since arrested four suspects, three of whom are believed to have taken part in the robbery. Investigators say several of the men are known for previous thefts and may have carried out the Louvre job on commission.

France's Culture Minister Rachida Dati announced that the Louvre Museum will install “anti-ramming” and “anti-intrusion” barriers by the end of the year.

Louvre director Laurence des Cars admitted that the museum's surveillance cameras failed to adequately cover the thieves' entry point, with the only nearby camera facing away from the balcony they used.

While Dati confirmed that internal security systems functioned during the robbery, she warned of “major flaws” in external protection.