Academic publisher Elsevier hit by LAPSUS$ redirect attack
Elsevier says a short-lived LAPSUS$ compromise redirected some visitors to a criminal leak page.
62
Organization
Elsevier
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenSep 22, 2026
- Last mentionedSep 23, 2026
Timeline
3 articles · newest firstElsevier Evolve, ClinicalPharmacology, and GSDD APIs Hijacked: LAPSUS$ Redirect Campaign
LAPSUS$ hijacked Elsevier education and clinical APIs, redirecting users to extortion splash pages.
75
Brief hijack makes Elsevier domains redirect to LAPSUS$ “Chapter II” page
Three Elsevier domains, including manuscript portal submit.elsevier.com, redirected for 78 minutes to a LAPSUS$ extortion page taunting the FBI.
72
Appears with
- LAPSUS$threat actor · 3
- Elseviervictim · 2
- Sorami Consultingorganization · 1
- ClinicalKeyproduct · 1
- ShinyHuntersthreat actor · 1
- LeapSpaceproduct · 1
- Securonixorganization · 1
- Scattered Spiderthreat actor · 1
- FBIorganization · 1
- Scattered Lapsus$ Huntersorganization · 1
- Cloudflareorganization · 1
- Vodafone Germanyorganization · 1
- Evolveproduct · 1
- ScienceDirectproduct · 1
- ClinicalPharmacologyproduct · 1
- Elseviervendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.