The Louvre's Video Surveillance Password Was 'Louvre' (pcgamer.com) 90
A bungled October 18 heist that saw $102 million of crown jewels stolen from the Louvre in broad daylight has exposed years of lax security at the national art museum. From trivial passwords like 'LOUVRE' to decades-old, unsupported systems and easy rooftop access, the job was made surprisingly easy. PC Gamer reports: As Rogue cofounder and former Polygon arch-jester Cass Marshall notes on Bluesky, we owe a lot of videogame designers an apology. We've spent years dunking on the emptyheadedness of game characters leaving their crucial security codes and vault combinations in the open for anyone to read, all while the Louvre has been using the password "Louvre" for its video surveillance servers. That's not an exaggeration. Confidential documents reviewed by Liberation detail a long history of Louvre security vulnerabilities, dating back to a 2014 cybersecurity audit performed by the French Cybersecurity Agency (ANSSI) at the museum's request. ANSSI experts were able to infiltrate the Louvre's security network to manipulate video surveillance and modify badge access.
"How did the experts manage to infiltrate the network? Primarily due to the weakness of certain passwords which the French National Cybersecurity Agency (ANSSI) politely describes as 'trivial,'" writes Liberation's Brice Le Borgne via machine translation. "Type 'LOUVRE' to access a server managing the museum's video surveillance, or 'THALES' to access one of the software programs published by... Thales." The museum sought another audit from France's National Institute for Advanced Studies in Security and Justice in 2015. Concluded two years later, the audit's 40 pages of recommendations described "serious shortcomings," "poorly managed" visitor flow, rooftops that are easily accessible during construction work, and outdated and malfunctioning security systems. Later documents indicate that, in 2025, the Louvre was still using security software purchased in 2003 that is no longer supported by its developer, running on hardware using Windows Server 2003.
"How did the experts manage to infiltrate the network? Primarily due to the weakness of certain passwords which the French National Cybersecurity Agency (ANSSI) politely describes as 'trivial,'" writes Liberation's Brice Le Borgne via machine translation. "Type 'LOUVRE' to access a server managing the museum's video surveillance, or 'THALES' to access one of the software programs published by... Thales." The museum sought another audit from France's National Institute for Advanced Studies in Security and Justice in 2015. Concluded two years later, the audit's 40 pages of recommendations described "serious shortcomings," "poorly managed" visitor flow, rooftops that are easily accessible during construction work, and outdated and malfunctioning security systems. Later documents indicate that, in 2025, the Louvre was still using security software purchased in 2003 that is no longer supported by its developer, running on hardware using Windows Server 2003.
Holy cow! (Score:2)
Man o man. What a good time to be a criminal!
That museum deserves to lose its entire collection.
Re:Holy cow! (Score:5, Interesting)
Actually this is a **LOT** more common than you think. I worked in physical security (key cards, cameras, alarms, etc.) For one thing, the multiple shifts all need to login, and security guards tend to be only about two steps above burger flippers in smarts (the brighter ones use it as a placeholder until they get a better job). The equipment is frequently on a private network disconnected from the rest of the corporate backbone, so outdated software is not really a concern as long as physical access to the end points is controlled. One of the last jobs that I did as a contractor was move the security system for our local Coast Guard base off their creaking old Windows NT 4.0 server, not because it was a security risk but because the hard drive was failing.
Another reason is because the system needs to be serviced, and the techs need to be able to log in even if they've never been to the site before. When I worked for a security contractor we frequently had to work on systems set up by other vendors, and we had a list of passwords that they used. (One of the larger installers used the same login/password on every system that they installed in North America for over a decade.) I instituted custom logins/passwords for each customer and we kept them in a shared Keypass database, this became a major selling point with our customers' IT departments. No one wants their biggest security hole to be their security system.
Re:Holy cow! (Score:4, Informative)
Back about ten years ago I was working at a regional hospital. I've told this story before on Slashdot, but it is relevant here.
I start working there and one of the first red flags was that these idiots didn't have individual user accounts set up. The entire system was based on Windows. They had a general account that everybody from the doctors to the janitors used, and it had a simple five letter password that everybody knew. So, well, basically useless. They had this idea that this made them comply with HIPAA. Uh, no. And their entry code to the ER ambulance entrance was 911. (That is not uncommon.) But it gets better.
They had a global Windows share drive that was a dumping ground for... everything. So this thing had everything from patient information to employee lists to social security number lists for employees to recipes (I kid you not) crappy soup in the hospital kitchen. It was insane. I warned them about it in the first two days or so that I was there and, of course, was ignored.
Predictably, they were shut down with ransomware in the middle of the night. Someone had infected a random computer and it hit that network drive, crippling the hospital. I was working at two in the morning and immediately knew what happened. So I called the IT emergency number and got some tech, who was clearly drunk off his ass. I was literally sitting there walking this guy through logging in on the phone. And knowing the basics of their network topology, I even told him the most obvious way to identify where it was introduced: It encrypted everything it saw, which included the network drive, but you just have to find the computer that has all its local stuff infected. Oh, and by the way, from the language of the ransom note, it was clearly someone from Eastern Europe or Russia. And so on. Eventually they fixed it but it took them about 12 hours.
Well, it gets even better. The morons had all the security cameras accessible on their local network. No VLAN, nothing. And they had a very predictable IP assignment for it. I think it was something like the floor and a camera number. So like 192.45.1.5 for camera 5 on the first floor. That really isn't so bad, except that it shouldn't be globally accessible from any computer in the fucking city. But wait! When you connect to it using a web browser, it squirts out the model number of the camera. And, as you can guess... No, they never set passwords on the damned things, and used the default password. We're talking literally Googling the model of the camera and finding out it was "admin" or something like that.
So I discover this when I'm bored one night on a 24 hour shift. So I'm flipping through cameras, and there were cameras in pretty weird places. Like the playroom for the children in pediatrics. Really, I don't want to know. There was also one on the roof that was a movable camera. I reported it and was ignored. A couple of weeks later, I turned the camera into a tree. When I came back two weeks later, it was still looking at the tree, so obviously nobody was looking at these things.
I won't even get into the shit that happened when they had a bomb threat from some asshat and their incredibly incompetent response to it. They demanded that everybody turn their cell phones off because... reasons I still don't understand. (The real reason was that they wanted a communications blackout.) But it was "Oh my god, if you use your cell phone it might detonate da bomb!" Sure. Well, when they locked down the place my cell phone was in my call room in the middles of the hospital. The local PD obviously had some kind of scanner they were using, because they kept circling around the closet I had to sleep in trying to find the phone. Being idiots, they never found it. In the middle of all this, because they had to have communications, they bring out cell phones the hospital had and start handing them out to critical personnel: Apparently their cell phones won't "set us up the bomb."
Oh, and while they were trying to tell everyone not to use cell
Re: (Score:2)
Holy cow!
Was there no agency you could have tipped off about it?
Re: (Score:2)
Holy cow!
Was there no agency you could have tipped off about it?
Of course. The problem was that because I'd previously brought some of the problems to their attention, they would have known it was me. Aside from them probably accusing me of "hacking" (what a joke), they probably would have sued me. And while a lawsuit like that would ultimately be unsuccessful, it would have tied me up and buried me in legal fees. Then it probably would have made me completely unemployable. When you have professional licenses and the job market already sucks, you don't want to have that
Re: (Score:2)
Was that in Alaska? Set up security for a hospital there which rotated through IT staff with amazing rapidity. Their corporate owner would only pay Lower 48 wages based on their headquarters location somewhere in the deep south. I saw their entire IT staff quit en masse and move to a new employer twice in the same year.
At some point they got a new switch which wouldn't fit where the old one was so it needed longer patch cords. Rather than buy a new box of 3-6 foot patch cords someone opened the box of 3
Re: (Score:2)
This load of horseshit was actually in Texas.
Camera in kid's playroom Re:Holy cow! (Score:1)
>So I'm flipping through cameras, and there were cameras in pretty weird places. Like the playroom for the children in pediatrics. Really, I don't want to know.
Either because parents wanted to be able to watch their kids, because of liability insurance reasons/fear of lawsuit, or because something you don't want to know about happened in the past/fear of lawsuit if it happens again.
I'm hoping it's the first one. It's not something I would encourage today due to hacking potential, but 10-20 years ago it
Re: (Score:2)
i doubt that it had anything to do with that, because there was absolutely no way for parents to access it. It was only accessible from within the hospital network. There might have been some gateway to the global Internet, but I did not find that. I did find a couple CT scanners accessible from the global Internet when I ran them into SHODAN.
Almost as good as when I was telling people where to go to get gas during Hurricane Harvey because all these stations left the meters on their gas pumps open to the In
Re: (Score:1)
Right we are talking about some ip cameras and old windows box with some hard disks and winforms ui built on windows video to do mpeg playback most likely.
Assuming its on restricted network and the cameras have access lists that only let the server really talk to them. I don't see this issue. I mean shit how old was the microcontroller code on the slow scan recorders the current system probably replaced?
obvious the controls around a purpose built special use system like this were *also lacking* but I can'
Re: (Score:2)
I can't see a good reason
Maintainability, first off. There are very few people out there who can maintain antiquated systems like that, and they charge an arm and a leg.
Reliability. Analog cameras fall over and die every few years, while I have personally worked on IP cameras that were over 20 years old. Older IP systems are generally locked into a limited selection of cameras, most of which have probably been discontinued. Backup solutions, even just for the config, were lacking in older systems, having to figure out what came
Re: (Score:1)
>That museum deserves to lose its entire collection.
If it were a privately-owned museum I might agree with you.
As a publicly owned museum owned by the people of France, I can't agree with you.
I will say that more than one person involved in the Louvre's security needs to be sacked if not prosecuted for criminal negligence, assuming any such laws apply.
Re: (Score:3)
I'm guessing the Security Supervisor's personal banking password was 'bank'?
Re:Holy cow! (Score:4, Funny)
1 2 3 4 5
It's the exact same code as my luggage!
Re: (Score:3)
1 2 3 4 5
It's the exact same code as my luggage!
I think that's your bank PIN. Your luggage would be 1 2 3, or the TSA compatible key from Ali Baba. :-)
Re: (Score:3)
Re: (Score:2)
I'm guessing the Security Supervisor's personal banking password was 'bank'?
"Banque". Note they do mix lower and upper. :-)
Re: (Score:1)
Ok, fair point.
So instead of losing everything the museum has, I'd say it is reasonable for the head of security to have the shit beaten out of him and then fired, and prohibited from ever holding a position of public trust ever again in his life.
Re: Holy cow! (Score:2, Troll)
I really want a slick produced show where an international team of non-European thieves engages in operations to repatriate stolen relics.
Would be difficult to get rights to film in the museums, though, in all likelihood.
Re: (Score:2)
Re: (Score:1, Troll)
I really want a slick produced show where an international team of non-European thieves engages in operations to repatriate stolen relics.
Why? So Isis/Dash/Taliban can destroy the pre-Islamic art?
"Built in the 6th century, the Buddhas of Bamiyan were two monumental size statues, standing at 115 and 174 feet tall, carved into the sandstone cliffs of the Bamiyan valley in central Afghanistan. These statues best exemplified the Gandharan Buddhist art school, as well as the greater cultural landscape of Buddhism and its influences during the 1st to 13th centuries. In 2001, the statues were destroyed by the Taliban over the course of 25 days. A
Re: Holy cow! (Score:2)
You're aware that ISIS didn't make that art right? How would it be repatriation?
Re: (Score:3)
These places existed before ISIS. If you want to limit repatriation to people who created things then almost by definition nothing in a museum should be given back.
Re: Holy cow! (Score:2)
Ok, but in this case, the statues would be repatriated to China from Afghanistan.
Re: (Score:2)
Ok, but in this case, the statues would be repatriated to China from Afghanistan.
The Buddhist statues were native to Afghanistan not China. And Buddha was from Nepal not China. Buddhism spread to many areas including Afghanistan.
Re: Holy cow! (Score:2)
Right. The statues were never stolen. That's why I'm confused about how these statues would be repatriated. I'm using China just because it's somewhere that's not Afghanistan that might have a cultural claim.
Re: (Score:2)
Right. The statues were never stolen. That's why I'm confused about how these statues would be repatriated. I'm using China just because it's somewhere that's not Afghanistan that might have a cultural claim.
The reference was to illustrate what some locals do with their cultural inheritance. That repatriation being a good thing depends entirely upon who you are repatriating to. After learning of those statues, would you be OK with repatriating non-Islamic cultural treasures to ISIS, Daesh, Taliban, etc?
Re: (Score:1)
You're aware that ISIS didn't make that art right? How would it be repatriation?
Repatriation may put art in the hands of ISIS or likeminded individuals. Some of the looted art is safer where it is.
Sorry, politically incorrect, but realistic at times.
Re: (Score:2)
The safe hands of Britain and France (Score:1)
Yeah, it would have been much better you barbarians had not supported the taliban fathers in the 1980s.
Nope. The mistake was to nation build in a tribal state. Post WW2 Europe, sure. Iran, Afghanistan no.
The post-9/11 invasion. No problem. Kill them, remove them from power, then leave with the warning don't make us come back and do this again.
It would have been great if your country did not destroy Iraq with a dumb lie used as an excuse
Again, your ignorance is showing. Saddam worked to hide the fact he had no WMD. He wanted the question to be an unknown to scare off Iran. This shit aint gonna fly post 9/11. Either prove you are clean or we are coming in to see for ourselves. The mistake was, again,
Re: Holy cow! (Score:2)
Wow. Troll, huh? How racist do you have to be to feel trolled by such an idea? Are we talking MAGA level? Or KKK?
They used both upper and lower case (Score:2)
Re: (Score:2)
Why? It's not like this had anything to do with the heist, and it's not like other places do it any better.
Heists are committed by dumb criminals, not state sponsored masterminds. Less Tom Cruise movies for you.
No wonder I couldn't get into their systems (Score:1)
I thought the password was ervuoL.
Windows Server 2003 belongs in an museum (Score:4, Funny)
Windows Server 2003 belongs in an museum
The Operational Museum Piece. (Score:5, Funny)
Windows Server 2003 belongs in an museum
Technically, it was.
The display just happened to be warehoused in the operational wing. Attached to a power plug. Connected to a wall socket. Powered on. And configured with a slightly insecure password policy, given the server name of "Louvre", the username of "Louvre", the passwo, yeah it's one hell of a museum piece.
Even the ILOVEYOU architects were impressed.
Re: (Score:3)
Technically, it was.
Woooshhh!!!!! Thanks for explaining the joke.
Re: (Score:2)
I trust Windows Server 2003 more than I trust Windows 11. It's less stable, but Microsoft isn't in control of your machine.
Re: (Score:1)
"one is pre owned and one will take a few minutes"
Ms shit is so bad that it should be considered negligent to use them. I guess the OSCP test got rid of linux in its simulations because people so would always go straight for the windows machines every time anyhow. It's really time we stop deluding ourselves that they're targeted because theyre so popular or the other standard industry microsoft apologetics and respond with ridicule instead of argument. This wasn't a situation that came about by logic or
Cyber Audits must be a good business (Score:2)
Re:Cyber Audits must be a good business (Score:4, Interesting)
which obviously in 2025 weren't fixed per the article
That's not what the article says, it merely wants to give that impression, because it's easier for them to get clicks that way.
Note the the only claims made as of the 2025 report are that they're using Windows Server 2003 and some old security software in some capacity. The stuff about the passwords is all from 2014 and 2015.
Re: (Score:2)
Unless that's an incredibly locked down Windows 2003 server, it's basically criminal negligence to be running such an out of date operating system. The fact it was setup with lousy passwords makes me believe it probably wasn't locked down either. They were asking for trouble with such poor security practices.
Re: (Score:2)
If it's on a private network with controlled physical access then it could be running DOS and it's not actually a security risk.
Re: (Score:1)
If it's on a private network with controlled physical access then it could be running DOS and it's not actually a security risk.
It's not a security risk if any other node connected to the same private network can compromise it? lol
Re: (Score:2)
In a different post I pointed out that you need to control access to the end points.
Re: (Score:3)
Had an instructor in college whose day job was doing pen tests for financial institutions. When they arrived at a site they'd be assigned a conference room, and while he started setting their equipment up his partner would get on the phone. Calling a branch office he'd say, "Hi, I'm Greg, the new guy in IT. I'm supposed to update the configuration on the router in your office, but I don't have the password and everyone else in my department is in a benefits meeting. They said your manager has the correc
More info (Score:2)
Check out the Hank Green interview with Sherri Davidoff on YouTube for a pretty nuanced look into the failures and successes of this heist.
https://youtu.be/NIGbQ9NHFEg [youtu.be]
Ssshhhh! Don't tell everyone your password! (Score:1)
Now we'll just have to locate every copy of the web page and have it dipped in acid to make sure no one can break in at a later date.
No Connection with Heist (Score:1)
12345 (Score:2)
( /s )
Re: (Score:2)
Alternatively, they at least could've gone with "Louvre2".
Re: (Score:2)
123@Louvre
Numbers, symbols, and at least one capital letter. Very strong password.
Re: (Score:2)
123@Louvre Numbers, symbols, and at least one capital letter. Very strong password.
Password Monster rates that as a weak password.
But hoooolld on a second. TIL there are sites where you can just type your password into!?!?
Jeebuz K. Ryste on a trampoline. We're lost, we're so lost.
Didn't Matter (Score:5, Informative)
The criminals effectively just did a smash-and-grab (plus guard threatening) while pretending to be construction workers. None of that poor IT security mattered. In other words, it doesn't matter that their new password was changed to "LOUVRE!".
Re:Didn't Matter (Score:5, Informative)
This. Virtually none of the museum break-ins (there have been a lot in Europe in the past 5 years) have looked anything like those stupid heist movies, or a computer game. Security and passwords are virtually irrelevant.
I'm reminded of a facility I once worked on. We had full time security and a gate. Ultimately we had a coked up copper thief who was barely able to control their car just drove in, stole some cable and a ladder, and drove out again. Turns out that the security guard on Sunday was the only person present and while he went to the toilet he opened the boom gate so that operations could come and go as they pleased.
We're trained by movies to think that thefts from secure facilities are some big brained Tom Cruise style parachuting in from a plane with sleeping dart guns and tools to stop the laser alarms from going off.
But in reality many thefts are just dumb. They aren't performed by ANSSI experts, they are performed by thugs with low tech.
Re: (Score:3)
It speaks to their generally lax security efforts. People imagine that the Louvre is some kind of Fort Knox style impenetrable fortress d'art.
Re: Didn't Matter (Score:2)
Re: (Score:2)
I think that link gave me cancer.
Remember? (Score:2)
When it was acceptable that historical artifacts would be "moved" (more like stolen) from African and Eastern countries to European museums like Louvre, so they'd be safer there? Yeah.
Re:Remember? (Score:5, Informative)
It might be ethically unacceptable by today's standards, but the state of the world still makes it technically correct. Museums of poorer countries get ransacked during wartime. Compare one spectacular heist at the Louvre and thoroughly looting the entire 100,000 piece collection of the Khartoum museum in Sudan last year.
1) Sudan National museum was looted and ransacked in 2023/2024; it contained 100,000 pices of art from the different cultures from the Nile Valley https://www.theartnewspaper.co... [theartnewspaper.com]
2) Destructions during the 2015 Syrian war https://en.wikipedia.org/wiki/... [wikipedia.org]
3) Destruction of religious and historic relics of Timbuktu, Mali during the 2012 war https://en.wikipedia.org/wiki/... [wikipedia.org] ; the International Criminal Court (The Hague) sentenced an Al Quaeda associate https://www.icc-cpi.int/mali/a... [icc-cpi.int]
4) Looting of Iraq Museum in 2003 https://en.wikipedia.org/wiki/... [wikipedia.org]
5) The very long list of cultural destructions by the Islamic State everywhere it passed by https://en.wikipedia.org/wiki/... [wikipedia.org]
Re: (Score:3)
Compare one spectacular heist at the Louvre
While you're not wrong about the Sudan museum, calling it one spectacular heist at the Louvre is disingenuous. Right now it's just the latest heist in a list of many in Europe in the past year. You just know what the Louvre is so it got international attention.
Funny enough the day after the Louvre heist was the day of the judgement of a court case of a woman who stole millions in gold nuggets from a the Museum of Natural History in Paris only a month prior. There was also a spectacular heist of the Helmet o
That does it! (Score:2)
Pack up the entire collection and move it to Llanfairpwllgwyngyll, Wales.
PC Gamer reports: ? (Score:2)
budgetary blame? (Score:1)
"was"? (Score:2)
I certainly envy the faith of the editor using the past tense there. What are chances they changed it? :p
Smart (Score:1)
The heist movie (Score:2)
Even the heist movie would choose a better password than that - otherwise the hacking scene would be boring - unless it was a comedy of course.
...and it has worked for decades (Score:2)
Was this relevant to the theft? (Score:2)
Obviously it sounds like basically no bad option was left unchosen when it came to their IT config; but I'm curious whether this was a situation where the perps were actually sophisticated enough (or unsophisticated at traditional smash-and-grab/balaclava-when-on-camera techniques) to incorporate the bad IT into the heist; or whether the entry was more or less pure physical access control failure that happens to put th
Re: (Score:2)
Has it been determined whether the IT situation was related to the theft that occurred?
If their IT security was this halfassed, then their physical security probably was too. They could have solved the IT security problem by hiring someone competent to do an audit, and then follow their recommendations. They obviously skipped at least one of those steps. That kind of sloppiness doesn't occur in just one area, it has to be systematic.
Video surveillance (Score:2)
Cameras, for what? Good news clips? (Score:2)
Re: (Score:2)
It happened in broad daylight and the thieves threatened physical harm to the employees. Sorry but nobody is paid enough to deal with that.
Re: (Score:2)
Re: (Score:2)
Aw, Geez [man rubs temples] (Score:2)
Meanwhile I'm out here making different passwords for each service or site I have, changing out the passwords every 3-4 years.
I'm gonna die and they'll just drop my machines in the grave with me.
It's even worse (Score:2)
To remove the Mona Lisa, the password is 'MonaLisa'.
They could at least have made it... (Score:2)
I am sure it is more secure now... (Score:2)
... that they have changed it to 'Louvre1'
Thank you! I'll see myself out.
They should have used "password"! (Score:2)
Or maybe...123456!
New password (Score:1)
New and totally secure password will be:
LouvreLouvre123