French authorities continue to search for the thieves responsible for Sunday’s Louvre heist as the museum security community reckons with the aftermath of a simple, yet stunningly effective, breach of security.

“Let’s face it—this wasn’t Mission Impossible. They weren’t parachuting in,” says Tim Carpenter, former director of the FBI Art Crimes Unit. “They climbed a ladder and used angle grinders.”

Investigators have not released names of suspects or persons of interest in the theft yet. But Carpenter, who now runs ARGUS Cultural Property Consultants, says that the thieves clearly found the major vulnerability at the Louvre by doing their homework, creating a plan, and then pulling off the job using basic tools.

he “low brow” heist fits into a broader pattern of criminal activity targeting museums with collections of small commodities that can be transformed and resold more easily than master paintings, Carpenter says. But because they successfully made off with the loot from France’s—and arguably the art world’s—premiere institution, the rest of the world is now taking notice of the trend.

“I think what this heist should do is wake everybody up to the fact that they’re all at risk,” Carpenter adds. “The risk of copycats because of this heist is quite high. We’re going to see more of these.”

Taking Advantage of Vulnerabilities

Sunday’s thieves took advantage of a series of vulnerabilities in the Louvre’s security posture.

First, they exploited the lack of perimeter security monitoring to drive a small lift truck—the kind used to move furniture into apartments in Paris—up to the exterior of the museum, park, extend the lift, and climb onto a balcony.

Only one surveillance camera was in their vicinity during these movements, and it was turned away from the thieves’ activity, Louvre administrators said in testimony before the French Senate on Wednesday.

Then, the thieves used a tool to cut into reinforced window glass to enter the Apollo Gallery. That triggered an alarm at the Louvre, but that did not impede the thieves progress as they approached display cases in the gallery, cut into them in a matter of minutes, and triggered another alarm. The display cases were updated in 2019, said Louvre President Laurence des Cars, but were designed to resist gunfire—not necessarily cutting tools. 

The thieves then removed nine significant jewelry items from the display case as security personnel focused on evacuating museum visitors to safety and notifying the police that a theft was in progress. The thieves then exited the same way they came in—out the balcony glass, down the lift, and onto motorized scooters to make their getaway. The thieves dropped one item—a royal crown—as they were making their getaway.

Security personnel at the Louvre, who are not armed, followed protocol to focus on preserving life safety and alert the police to intercept the thieves. Louvre Security Chief Dominique Buffin said staff in the museum’s control room immediately acknowledged the window alarm and looked at surveillance video feeds while also receiving radio reports about the event. Security staff then called the police at 9:35.33 a.m.—five minutes after the robbery began.

Security personnel at the visitor entries then ran out to the exterior of the museum, near where the thieves’ lift truck was parked, and prevented the thieves from setting fire to it. The police, however, were unable to respond to the scene in time to catch the thieves before they disappeared into Paris.

Timing Is Everything

The entire heist lasted just nine minutes, with the thieves only inside the gallery space for four of them.

This quick timeframe played to the thieves’ advantage. It allowed them to breach minimal security layers to enter a critical gallery in the Louvre and steal some of the most valuable jewelry in France before fleeing.

Protecting the Louvre collection is a massive undertaking, and administrators said in a French Senate hearing on Wednesday that they have struggled to maintain a modern security system across the historic site. This struggle extends to the perimeter of the museum, where the thieves were able to take advantage of the lack of exterior security monitoring to set up a small lift truck to climb onto a balcony outside the Apollo Gallery without being detected.

“We are weak in perimeter protections of the Louvre,” said des Cars. “That is where we have fallen down, and that’s a long-standing failing.”

Des Cars joined the Louvre in 2021, and during the last four years she has pushed for more funding for infrastructure upgrades to address water vulnerabilities, security lapses, staffing challenges, and overcrowding. France finally approved a major project earlier this year—called Louvre Renaissance—to spend €400 million to address these problems, but des Cars lamented in testimony that the upgrades will only come after Sunday’s successful heist.

The incident has refocused attention on the core security strategy of creating rings of protection for a defense-in-depth strategy, says Doug Beaver, CPP, independent cultural protection security consultant, former security director at the National Museum of Women in the Arts.

While listening to Wednesday’s hearing, Beaver says he was struck by des Cars’ comments about the neglect of the Louvre’s technical and physical security infrastructure despite the institution’s prestige.

“This should give both large and small cultural institutional leadership pause to consider when the most recent security and vulnerability risk assessment was completed, and if identified priority vulnerabilities were acted upon,” says Beaver, who is also a member of the ASIS International Cultural Properties Community.

In modern museum security, the perimeter layer—the outermost ring—is the first opportunity to detect, deter, and delay a threat before it breaches the building or reaches a gallery. Museums can use passive barriers, technological systems, and human intervention to do this, Beaver adds.

Passive barriers, for instance, can include laminated glazing, security film or polycarbonate reinforcement, concealed window fixings and glazing beads to prevent prying or cutting. Controlled vehicle access is also a passive form for perimeter security. Technological systems, meanwhile, include video analytics, outdoor-rated cameras that use motion detection, loitering, and trip-line analytics to detect approach patterns; infrared or microwave motion sensors to form an invisible detection boundary along facades or courtyards; and fence-mounted vibration or acoustic sensors—useful for sculpture gardens or perimeter fences in open-air museums.

None of these measures will necessarily stop a motivated thief. But what they will do is give security personnel more time to detect and respond to the threat actor, ideally preventing them from successfully completing a theft.

“Even though the alarm triggered and security responded, the thieves still entered and exited in minutes,” Beaver says.  “This indicates to me that case alarms in addition to guard presence may require hardening and not be sufficient for ultra-high value items. Despite alarms and sensors, the display cases were breached quickly.”

Placement. One of the major critiques of the Louvre’s security posture following Sunday’s theft was that France’s crown jewels were placed in a gallery that is near the exterior of the museum.

The museum is not alone in its practice of placing high-value items in areas that are near the perimeter of the institution. Carpenter says he recently completed a security assessment for a client, which had placed several valuable household name paintings in locations with no cameras, limited security coverage, and next to a fire exit.

“Accepting the environment as it is, why do you have your most valuable, recognizable paintings in this room?” Carpenter says. “Why can’t we just move these paintings into a different gallery space that’s a bit deeper?”

Moving high-value and important collection pieces deeper into the museum means that thieves would need to enter further into the facility to steal them, encountering more security layers along the way and giving security additional time to detect and respond.

An infographic titled “‘Historic’ seven-minute heist at the Louvre Museum” created in Ankara, Turkiye on 20 October 2025. (Photo by Murat Usubali/Anadolu via Getty Images)

Monitoring. The Louvre has a video surveillance system in place, but des Cars said the current system is outdated and is in the process of being updated to a more modern ecosystem.

But video surveillance is only an evidence-gathering tool for most museums, which can have hundreds of cameras on their campus, unless they are actively monitored and using analytic capabilities, Carpenter says.

“When I was in the FBI, I wanted camera coverage. But they only serve as evidence. They don’t stop anything,” Carpenter says.

Video cameras that leverage analytics, however, can alert security personnel to a potential problem in time to prevent it from escalating. For example, Carpenter says one security vendor has designed a solution that allows operators to draw a virtual frame around an individual artwork to then alarm if someone gets too close to the item.

“If someone breaks the plane, it can do one of several things, such as send an alert to the control room or it’ll play a message over the loudspeaker,” says Carpenter, adding that the method is effective in reducing incidental touching of artwork as well as for theft alerts.

Museums can also deploy crowd monitoring analytics, using artificial intelligence (AI) to learn how people normally move through the museum and to issue an alert for people going against this typical flow.

One challenge for museums that are historic sites like the Louvre, which is a UNESCO world heritage site, is the regulations that often limit the installation of security equipment on the exterior of the museum. Ibrahim Bulut, CPP, senior security consultant, museum security expert, Expertise & Security Consultants, says that historical buildings—such as those protected by UNESCO—have restrictions that protect the view of the building itself.

“You can’t put anything on your outside perimeter to look towards the building,” he says.

During a stint as the interim security and project manager for historical sites in Bruges, Belgium, Bulut says he dealt with this exact challenge. His approach at the time was to increase security measures inside the perimeter of the sites.

The Louvre may be taking a similar approach. In testimony, des Cars said the Louvre was looking to add new surveillance cameras and overhauling its monitoring capabilities throughout the campus.

The Louvre has developed a security equipment master plan, which will be under contract by the beginning of 2026, to renovate its command room and its five security control rooms, said Francis Steinbock, deputy general administrator of the Louvre. All of the museum’s security hardware is at stake as part of the project, including 60 kilometers of new cabling needed to support the electrical infrastructure the security hardware depends on.

“Our first priority was securing the estate,” Steinbock said. “Then we had security hardware we are thinking about—video surveillance and access control.”

Glazing. Many museums rely on bullet-resistant glazing alone for their display cases, but this still means they are vulnerable to cutting tools. Instead, museums would need to install display cases that meet other glazing standards—such as EN 356—to be more resistant to manual and tool attacks like impacts, cutting, and repeated blows, Beaver says.

Bulut previously worked for a display case manufacturer. He says that while the display cases that are most resistant to brute-force attack display cases are expensive, they can be a worthwhile investment for museums looking to protect their most valuable items.

For instance, these types of display cases are used to protect the remaining panels of the Ghent Altarpiece, or The Adoration of the Mystic Lamp, after two panels were stolen from the museum in 1934. One was anonymously returned to the museum, but the other panel remains missing. Bulut says the museum uses a display case to both protect and preserve the rest of the panels from future damage.

Police. Some have criticized the Louvre security response to evacuate the galleries and focus on life safety while depending on law enforcement to intercept the thieves.

But this is a common and professionally endorsed practice in the museum field, Beaver says. Nearly all cultural institution protection frameworks, including those from the International Council of Museums and ASIS International, make human life the priority for security. Evacuating visitors and staff safely, avoiding direct confrontation with armed or unpredictable offenders, and notifying law enforcement is the norm in museum, bank, and retail security, he adds.

This should give both large and small cultural institutional leadership pause to consider when the most recent security and vulnerability risk assessment was completed, and if identified priority vulnerabilities were acted upon.

The effectiveness of this model does depend on how quickly and precisely law enforcement can respond. Bulut says that security directors should assess the average time that it would take law enforcement to respond to a call for assistance at their museum and then prepare their security measures appropriately.

“Create barriers—and time-consuming barriers,” he says. “Slow down the thief with a layered concept. Maybe they can still enter, but it will take more time.”

For instance, Andy Davis, CPP, managing director at Trident Manor and consultant security advisor for Arts Council England, suggests for a gallery with a balcony window adding timber shutters, cross bars, vibration sensors, and even infrared coverage to alert security of a break in.

“You want early notification as soon as possible so you can enable a response,” Davis says. “You have to understand how long that response might be, especially if you’re in an isolated location and it takes 20 minutes for the police to respond.”

To lower that time to respond, des Cars testified that she would like to see the Paris police create a police station within the Louvre estate.

“A presence of a police station within the Louvre would allow us to intervene quicker and more effectively,” she said. “It might also provide a more effective deterrent to people who might try to steal items of our collection.Criminal Patterns

Robert “Bob” Combs, assistant vice president, visitor services and security, J. Paul Getty Trust, says that commodities theft has been a persistent problem for museums. For nearly the past 20 years, Combs has presented a year-in-review of museum security incidents at the Smithsonian Institute’s National Conference on Cultural Property Protection to help security practitioners identify trends and patterns. He also shares the review with the security team at J. Paul Getty Trust to reduce the biggest risk that cultural properties face: complacency.

“For the most part, bad things don’t happen at any particular institution,” Combs says. “Security officers could work at your institution for years and never face a theft. One of the reasons I started to do the review is it’s a great tool for when thefts happen, we can go over them with the security team. It’s a great way of keeping them tuned up and thinking about our what-if scenarios. Everyday there’s a theft or significant incident happening at some cultural property.”

In his review of incidents between October 2025 and September 2025—when the conference was held—Combs says that he identified four major risk factors that the Louvre heist had elements of.

“The first of those that we’ve seen over the years is a huge trend to steal items that have commodity value—things that are small, portable, that have high breakdown value,” Combs says. “The tragic thing is it loses its historic value, but the commodity value is enough to motivate a thief to take this risk.”

The second trend is that the thieves capitalized on the appearance of being engaged in construction activity. Construction at cultural properties sites carries a huge risk of fire—such as the Notre Dame cathedral blaze—and of theft because there are new entrances being created onto the property that may not be part of the existing security plan.

“A lot of time museums when they’re working on a façade, they put up scaffolding,” Combs shares as an example. “Most security defenses are built around grade level—they assume the main threat is going to be through doors and windows.”

But with that new scaffolding or ladder in place, thieves now have access to higher levels of the museum that might not have the security systems in place to detect malicious activity outside of a window or balcony door. In 2003, for instance, alarm technician Robert Mang climbed scaffolding outside the Kunsthistorisches Museum in Vienna, Austria, to breach a window and steal a gold-plated saltcellar sculpture by Benvenuto Cellini.

The third trend that aligns with recent cases is the smash-and-grab technique the Louvre thieves used, Combs adds. In these attacks, perpetrators know they are going to set off alarms during their robbery and they do not care.

In November 2024, for instance, thieves on scooters disguised with helmets, masks, and hoods rode into the courtyard of the Musée Cognacq-Jay Paris while carrying axes and baseball bats. They broke open a display case to steal seven rare snuff boxes on display on loan from the Louvre, the British Royal Collection, and the Victoria and Albert Museum. One of the snuffboxes stolen once belonged to King Charles III and had 3,000 diamonds on it.

In another dramatic robbery, thieves used explosives to breach a door at the Drents Museum in Assen, The Netherlands, and steal four golden objects, including the helmet of Coțofenești, which was on loan from the National History Museum of Romania.

Des Cars said that the brute force attack method that Sunday’s thieves used to steal from the Louvre will need to be considered when replacing and updating the museum’s security posture. Thieves are increasingly targeting museums’ collections of precious metals, jewelry, and stones—similar to smash-and-grabs seen at jewelry shops.

“We’re seeing a change in the modus operandi of the thieves, and we will need to adapt,” des Cars said.

Erin Thompson, professor of art crime at John Jay College of Criminal Justice, says that the Louvre theft is not that surprising considering the “rash of incidents” where people have targeted materials on display at museums for the sake of the value of their raw materials.

Jewelry, for instance, can be disassembled, the settings melted down, and the stones recut—all to then be resold in the legitimate market. The one exception is diamonds, which regulations require to have individual certificates to certify they are not conflict or blood diamonds. But Thompson adds that those certificates can be forged, and not all buyers necessarily require them, so the thieves can find a way to sell the thousands of historical diamonds stolen from the Louvre.The ability to repurpose art and historical works for resale means that thieves can obtain more profits from their thefts than perhaps they would get from stealing a painting, which has limited—if any—resale value because it’s stolen.

“For art, the value is really dependent on the market and what collectors are willing to pay for it,” Carpenter says. “A piece of art only has monetary value if it sells authentically. You need a clean title.”

The tragic thing is it loses its historic value, but the commodity value is enough to motivate a thief to take this risk.

Thieves can’t make money by selling traditional fine art, so they are turning to other avenues to target gemstones and precious metals with intrinsic value. Security directors need to stay abreast of these new targets and attack methods, Davis adds.

“We like to say that if something happens in mainland Europe, it’ll be in the UK in three to six months,” he says. “Organized crime groups will share information…so if there’s an event that occurs and has the potential to impact your organization, you should review if this could happen and if you have vulnerabilities.”

Beaver suggests creating a cross-departmental review team of security, facilities, curatorial, and risk management to look at how thieves breached the perimeter and display cases, the detection and response measures that worked or failed, and how communication flowed between stakeholders.

“These three questions would ensure that the team internalizes the event as a real-world training scenario, not simply a distant news story that ‘will never happen to me,’” he adds. “I would then follow up with a re-evaluation of our layered approach and use the incident to reassess each layer of our protection strategy, including the perimeter, building envelope, interior zones, and object protection systems.”

While the Louvre has reopened, Carpenter says he hopes that this moment makes cultural property institution leadership reevaluate the resources they are giving to their security teams and consider new security measures, even those seen as disruptive to visitors, to prevent theft or intentional damage to collections.

“Security at the museum should get equal measure to all the other programs at the museum because they have a fiduciary responsibility to preserve and protect,” he adds. “Would you rather have a couple angry visitors who leave you a bad review online? Or would you rather lose your crown jewels and have them gone forever?”