Britain’s museums and galleries are being left vulnerable to thefts and cyber-attacks that could put priceless collections at risk, MPs have warned.

A report by the public accounts committee (PAC) said big security failures in recent years, including the theft of thousands of artefacts from the British Museum and a devastating cyber-attack on the British Library, had exposed serious weaknesses across the sector, but that the government had failed to take a strategic approach to preventing similar incidents.

The warning comes less than three years after the British Museum revealed that about 2,000 objects had been stolen, damaged or gone missing from its collections over a period of years, in a scandal that led to the resignation of its director, Hartwig Fischer.

The same year, a ransomware attack on the British Library crippled its digital services for months and led to the theft of staff and user data.

The committee said such incidents highlighted the need for stronger oversight of both the physical security of collections and museums’ digital infrastructure. While the Department for Culture, Media and Sport (DCMS) had facilitated discussions about recent breaches, MPs said it had been unable to identify concrete actions taken across the sector as a result.

The concerns come amid growing scrutiny of museum security internationally. Last year, thieves broke into the Louvre’s Apollo gallery and stole eight priceless 19th-century French crown jewels in under eight minutes.

MPs called on the government to set out what measures museums and galleries had introduced to tackle cyber and physical security risks, including wider use of digital record-keeping systems that could help prevent items disappearing from collections unnoticed.

Sir Geoffrey Clifton-Brown, the chair of PAC, said: “Cyber-attacks, the theft of items from collections, and a fall in the number of visitors are just some of the issues museums and galleries are fighting to overcome.”

The report found that although UK museums and galleries generated £563m in self-generated income in 2024-25 – a 53% real-terms increase compared with 2021-22 – visitor numbers had yet to recover fully to pre-pandemic levels and institutions continued to face rising staffing and energy costs. There was also a 16% real-terms reduction in government funding after emergency pandemic support came to an end.

MPs said DCMS lacked a clear picture of whether museums and galleries were delivering value for money for taxpayers, and had failed to establish meaningful metrics to assess their performance.

The PAC also questioned whether the current funding model provided sufficient incentives for museums to become financially resilient. It noted that the government was considering proposals to charge international visitors for entry to national museums, after recommendations made by the Labour peer Margaret Hodge in a recent review.

Concerns were also raised about governance across the sector. As of October 2025, 15% of trustee positions across the 15 government-sponsored museums and galleries were vacant, while the average appointment took 219 days to complete – more than double the government’s target of 90 days. MPs called on DCMS to explain how it would ensure boards had the skills needed to oversee increasingly complex organisations.

Clifton-Brown said museums and galleries were “a treasured part of the fabric of our nation” but were being “let down by a lack of leadership” from government.

“Our museums and galleries play a priceless role in educating people, preserving our shared history and showcasing our country to the world,” he said. “They’ve made great strides to become more financially resilient, however the lack of centralised support is leaving them vulnerable.”

Vernon Rapley, a museum security consultant, said business had been “sadly very good for me” during the last couple of years. Rapley, a former Met police art crime specialist, was head of security at the V&A for 15 years.

He said: “Museums are vulnerable. They have high-value items, they’re world-famous, public venues, and people will look to exploit that.”

“I’ve been thrown off my feet by the level of concern venues have. The British Museum thefts highlighted the insider threat, while cyber-attacks can cause long-term damage to collection management systems. And then you’ve got the slightly strange Louvre burglary Despite statistical evidence to show it’s not that common, every director in the country is terrified that it might happen to them.”