The Louvre Museum in Paris, which fell victim to a daring break-in involving a furniture elevator last month, has been struggling for more than a decade to upgrade the outdated Windows software it uses, including that which controls its video surveillance systems, according to a French newspaper report.
See also: Nintendo opens its museum in October
The thieves used a furniture lift to enter through a second-floor window on Oct. 19, stealing eight pieces of jewelry. Alarm systems on the window and the display case containing the jewelry worked as expected, according to France's Culture Ministry, and police were on the scene within three minutes. The raid prompted a complete overhaul of security at the museum.
The Inspectorate of General Cultural Affairs (IGAC) submitted its first findings last week, urging the Minister of Culture to propose new governance rules and security policies, the installation of additional security cameras around the perimeter of the building and an urgent update of all security protocols and procedures by the end of the year. Details of the report remain confidential.
However, numerous IT problems related to security systems were already apparent as early as 2014 and 2017, according to previous confidential audits of security systems seen by the French newspaper Libération. The museum was still using Windows 2000 on its office automation network when the French National Agency for the Security of Information Systems (ANSSI) conducted the 2014 audit, the newspaper reported — even though Microsoft had stopped providing security updates for that version of its operating system three years earlier, in July 2010.
See also: Windows 11 24H2/25H2 update causes Task Manager to launch after shutdown
The audit report also identified a video surveillance server with the password “LOUVRE” and a video surveillance application made by Thales with the password “THALES,” the newspaper reported. ANSSI naturally recommended using more complex passwords, migrating software to versions supported by developers and patching vulnerabilities.
A second audit was carried out in 2017, this time by the French National Institute for Advanced Studies in Security and Justice (INHESJ). “Some workstations have outdated operating systems (Windows 2000 and Windows XP) that no longer guarantee effective security (no antivirus updates, no passwords or session lock…),” Libération reported, citing the audit.
Microsoft ended extended support for Windows XP in 2014. The newspaper also reviewed tenders and other procurement documents issued by the museum in the years following the audits. Twenty years of technical debt weighed on security at the Louvre, as it steadily accumulated systems for analog video surveillance, digital video surveillance, intrusion detection and access control, some of them with dedicated servers or proprietary applications. Some of these became obsolete over time and needed to be updated or replaced.
See also: Microsoft Graphics Device Interface: Vulnerabilities allow code execution
The Louvre's Windows problems continued at least until 2021, when another document reported using Sathi on a computer still running Microsoft Windows Server 2003, which reached the end of extended support in 2015. There is no indication that the Louvre's long-standing software problems are linked to the recent breach, but the IGAC report last week highlighted a series of security failures, including inadequate surveillance systems and underestimation of intrusion risks stretching back 20 years.
