Breaches and incidents
Elsevier: main site, Evolve and Submit portals redirected to “LAPSUS$ GROUP, Chapter II” page
Help Net Security, citing Cloudskope, reported that elsevier.com, the Evolve nursing and health-education login portal and the Submit manuscript portal...
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- Help Net Security, citing Cloudskope, reported that elsevier.com, the Evolve nursing and health-education login portal and the Submit manuscript portal redirected to a LAPSUS$-branded page from roughly 7:49pm CT until before 10:09pm CT on 21 Sep 2026, at least 78 minutes.
- Root cause: not confirmed by Elsevier; Cloudskope believes it was a change “at the DNS or CDN edge: a DNS record, a CDN redirect rule, or the account that manages them”, and a forum claim that Cloudflare redirect rules were altered could not be verified.
- The page was branded “LAPSUS$ GROUP, Chapter II”; Securonix found no evidence linking it to the original 2021 to 2022 group.
- Elsevier said “Our investigation indicates that this was a narrowly scoped, limited-duration event”, that it was resolved, and “There is no indication that core platforms, customer data, research content, or operational systems were compromised.”