More from the article ...

... Moreover, the National Cybersecurity Agency of France (ANSSI) discovered that the museum's office network used obsolete systems, such as Windows 2000, which no longer guaranteed antivirus updates.

In 2017, a security audit report stated that the threat of an attack with potentially dramatic consequences could no longer be ignored.

It's unclear whether the passwords remained unchanged during the time of the heist and whether other security shortcomings were addressed. ...