Elsevier Domains Briefly Redirected to LAPSUS$-Branded Page
Summary
Three Elsevier domains redirected to a LAPSUS$-branded page for about 78 minutes. Researchers suspect a DNS or CDN change; Elsevier has not explained the incident or confirmed whether user data was exposed.
Key points
- Elsevier.com, Evolve[.]elsevier[.]com, and Submit[.]elsevier[.]com redirected visitors to a page branded “LAPSUS$ GROUP, Chapter II.”
- Cloudskope researchers said the redirect lasted at least 78 minutes on September 21, 2026; the portals were restored and functional afterward.
- Researchers suspect a DNS record, CDN redirect rule, or account managing those settings was changed, but the precise cause is unknown.
- A Chinese-language forum post alleged that the actor altered Elsevier’s Cloudflare redirect rules; researchers could not verify the claim.
- Elsevier had not said whether login credentials or other user data were exposed.
- The page claimed LAPSUS$ was returning, but Securonix researchers said available evidence does not establish continuity with the original group.
Article Details
- Victim Organization
- Elsevier
- Incident Type
- Brief hijacking and redirection of three Elsevier web domains to a LAPSUS$-branded page; the method is unconfirmed.
- Incident Date
- 2026-09-21
- Operational Impact
- Elsevier.com, Evolve.elsevier.com, and Submit.elsevier.com redirected visitors for at least 78 minutes. The domains were restored and reported functional. Whether user data was exposed is unknown.
- Ransom Or Extortion
- The redirect page displayed a LAPSUS$-branded taunt and a countdown to another alleged victim. No ransom demand or extortion of Elsevier is reported.
- Claim Status
- confirmed