You’ll never guess the Louvre’s onetime CCTV password. (You absolutely will)

This photograph shows a furniture elevator used by robbers to enter the Louvre Museum, on Quai Francois Mitterrand, in Paris on October 19, 2025. (Credit: Dimitar Dilkoff/AFP/Getty Images via CNN Newsource)

It’s the smoking gun behind the most spectacular heist this side of the Millennium.

A French court released a report Thursday slamming the leadership of the Louvre for its focus on headline-grabbing purchases and renovation projects over maintaining the security of on of the world’s largest museums.

The audacious daytime robbery, which saw four men walk away with priceless historic jewellery, was a “deafening alarm signal,” Pierre Moscovici, president of the Court of Accounts, which authored the report, told journalists Thursday.

Echoing the report, which was commissioned before the October 19 heist, he said that the museum leadership had prioritized “visible and attractive” projects, like art purchases and revamping the museum layout at the detriment, notably, of the Louvre’s security .

Since the heist, information has resurfaced showing that gaps in security appear to have been known for years – including a 2014 warning that alleged one of the museum’s key passwords was simply “LOUVRE.” The new report only adds to a number of security failings exposed by the heist.

So what went wrong?

Eyes on

Within four minutes of arriving at the outside wall of the Louvre, the thieves had scaled the building and were breaking through a window. Only then were internal alarms triggered. Four minutes later, after breaking into a reinforced case and grabbing nine pieces of historic jewelry, the thieves were making their escape.

“The weaknesses of the protection of our perimeter are known and identified,” Louvre director Laurence des Cars told lawmakers after the heist.

Internally too, the situation seems stark.

For the Louvre’s 465 museum galleries, security staff had only 432 CCTV cameras to monitor the interior in 2024, according to the report. While that’s a nearly 50 per cent increase on the number available in 2019, it still left 61 per cent of the galleries without any CCTV coverage.

The world’s largest museum, the Louvre covers some 652,300 square feet.

In comparison, the Detroit Institute of Arts boasts a similar footprint (including a theatre and recital hall) but has over 550 CCTV cameras, according to camera manufacturer Axis.

Des Cars told French senators that she envisions a doubling of the number of cameras within the 37-hectare Louvre property in the years to come.

In its recommendations, the Court of Accounts’ report stressed the need for the Louvre to “strengthen its internal control function, which remains underdeveloped for an institution the size of the Louvre.”

Foolproof cybersecurity

The holes in the Louvre’s security weren’t all physical. In the virtual realm its track record left much to be desired.

A 2014 report from the French information security agency (ANSSI) seen by French daily Liberation claimed that the password for the server managing the museums’ sprawling CCTV network was simply “LOUVRE.” Access to software managed by the security technology company Thales was protected by a similarly foolproof password: “THALES” – according to Liberation.

In the security audit, ANSSI reportedly recommended the Louvre boost its cyber security as well as move away from outdated software that could jeopardize its protective stance.

ANSSI did not deny the report to CNN but added that the audit, “cannot be considered representative of the current level of security” of the Louvre’s IT systems.

Bling, bling

The report focused on the museum’s budgetary priorities in recent years, which saw some 27 million euros (US$31.1 million) spent on maintenance works between 2018 and 2024, with a further 60 million on restoration of the Louvre palace.

In contrast, that period saw the Louvre splash double that figure on altering the museum layout and buying up artworks.

The museum spent 105 million euros on artworks in the six years to 2024, sweeping up 2,754 pieces in that time.

In 2021, the Louvre spent some 5 million euros on two works by French Rococo painter Jean-Honoré Fragonard. In April 2025, the Louvre made a 2.2-million euro purchase of an “exceptional” Fabergé triptych.

Many of the Louvre’s purchases are clouded in a certain secrecy, particularly regarding the purchase price. The Court of Accounts’ report said the Louvre should pay greater attention to the price of acquired works and specifically warned the museum against buying art works at a higher price if they were sold at auction for less than two years prior.

Heads firmly in place

In contrast to the focus on glitzy, eye-catching purchases, the damning report notes astonishing delays to work on the Louvre’s security infrastructure. Recommended security upgrades from a 2015 audit still won’t be completed until 2032, it revealed.

The report examined nearly eight years of museum operations across periods helmed by two executives.

At the time of publication, no executives (or other staff) have been fired or resigned over the theft.

The offer of des Cars to resign as museum director was not accepted by French Culture Minister Rachida Dati.

Dati – known as something of a political bulldog in France – has aggressively defended the Louvre since the embarrassment of the October 19 heist.

“Did the Louvre Museum’s security measures fail? No, they didn’t. It’s a fact. The Louvre Museum’s security measures worked,” she told lawmakers on October 21.

The following day, Macron requested an acceleration of improved security measures at the museum.

The following week, Dati had softened her tone, admitting to French senators that although installed security systems had functioned and staff had followed protocol “to the letter,” the “spectacular theft” was obviously a failure for the museum.

“Security failures did indeed occur,” she said.