Loading story…
Thieves broke into the Louvre Museum in Paris by using a furniture lift to access a second-floor window, stealing eight pieces of jewelry. Despite the alarm systems functioning correctly and police responding within three minutes, the incident triggered a comprehensive review of the museum's security measures. The French Ministry of Culture has since recommended new governance rules, enhanced security policies, additional perimeter cameras, and an urgent update of all security protocols by the end of the year. Details of the Inspectorate General of Cultural Affairs' report remain confidential.
Investigations revealed that the Louvre has struggled for over a decade with outdated IT infrastructure, including the use of unsupported Windows operating systems such as Windows 2000 on its office automation network. Confidential audits from 2014 and 2017 highlighted persistent security issues, including weak passwords on video surveillance servers. These longstanding vulnerabilities have raised concerns about the adequacy of the museum's cybersecurity posture, especially in light of the recent physical breach and the critical role of IT systems in protecting valuable assets.
Map this exposure pattern across your cloud, code, and identities.
2 events from the most recent confirmed update back to the earliest known activity.
Follow-up coverage said the burglary exposed what was characterized as decades-long security shortcomings at the Louvre, broadening the narrative from delayed updates to systemic security weaknesses. This represented an escalation in understanding of the institution's security posture.
Reporting indicates the Louvre had postponed Windows security updates and was operating outdated Microsoft systems prior to the burglary. The delayed patching and legacy software use were identified as pre-existing conditions before the incident.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
3 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcecsoonline.com
Open sourcecio.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A cyberattack on **Irec SAS**, the French subsidiary of online ticketing provider **Vivaticket**, disrupted online reservations for nearly **3,500 museums, monuments, and cultural sites across Europe**. Major attractions affected included the **Louvre**, **Musée d'Orsay**, **Musée du Quai Branly**, the **Arc de Triomphe**, the **Eiffel Tower**, and **Notre-Dame de Paris**, with some booking services remaining unavailable after the intrusion. French authorities, including the national cybersecurity agency and law enforcement, were engaged to determine the scope of the incident, while impacted institutions began notifying customers and assessing operational and financial fallout. The **RansomHouse** ransomware operation claimed responsibility and said it exfiltrated personal and reservation-related data from Irec systems, including names, email addresses, purchase history, reservation details, login timestamps, account metadata, and country of residence. Vivaticket said its investigation had found **no evidence that credit card or banking data was accessed**, but the breach raised concerns over exposure of customer information tied to travel and cultural visits across France and other European destinations.
Jun 29, 2026
The French Interior Ministry confirmed a cyberattack that compromised its email servers, allowing attackers to access certain document files. In response, the ministry implemented enhanced security protocols and access controls, while an investigation was launched to determine the origin and scope of the breach. Authorities have not yet confirmed whether any data was stolen, and are considering multiple possible motives, including foreign interference, hacktivism, or cybercrime. The Interior Ministry, which oversees police, internal security, and immigration, is considered a high-value target for both state-sponsored and criminal actors. The incident was reported in several news roundups, highlighting its significance within the broader context of European cybersecurity threats. While attribution has not been established for this specific attack, previous campaigns against French government entities have been linked to Russian state-sponsored groups such as APT28. The breach underscores ongoing concerns about the vulnerability of critical government infrastructure to sophisticated cyber threats and the need for robust incident response and investigation procedures.
Jun 29, 2026
A new Cisco report highlights the growing risk posed by legacy and unsupported systems within national critical infrastructure, revealing that nearly half of global business network assets were already aging or obsolete as of 2020. The United Kingdom, in particular, faces significant exposure, with 228 legacy systems identified across government in 2024 and over a quarter at high risk of operational or security failure. The report underscores that unsupported systems, often located at network edges, are prime targets for attackers, and that a majority of breaches in the EU during 2022 and 2023 exploited vulnerabilities with available but unapplied patches. Healthcare and other essential sectors are especially vulnerable due to concentrated use of outdated technology. Recent cyberattacks have increasingly targeted legacy firewalls and network devices, with state-sponsored groups exploiting known vulnerabilities in products from vendors such as Cisco, SonicWall, Palo Alto Networks, and Fortinet. Research indicates that 60% of enterprise firewalls fail high-severity compliance checks, reflecting deeper governance and patch management issues. Attackers are leveraging these weaknesses, often chaining exploits across network edges and VPNs, while defenders struggle with fragmented vendor alerts and outdated risk frameworks. The persistent use of unsupported technology and delayed patching continues to undermine national resilience and exposes critical infrastructure to significant cyber threats.
Jun 29, 2026