Elsevier (Victim): news timeline & CVEs

Week in review: Gyazo breach exposes 23.6M user data, TASK#STOMP steals documents

Weekly roundup leads with a Gyazo breach of 23.6 million users and the TASK#STOMP document-stealing backdoor.

Helpfeel confirmed that hackers exploited a Gyazo server flaw and stole 23.6 million user records. The same weekly digest details TASK#STOMP, a Windows backdoor that uploads business documents and also takes Wi-Fi passwords, clipboard text, and screenshots. A Chinese-speaking actor exploited CVE-2026-7273 on 996 unpatched Zyxel GS1900 switches in 48 countries, and Check Point said CVE-2026-93616 has been exploited since July 23, 2026. Elsevier domains were briefly redirected to a LAPSUS$ page, while DarkMe is now spread by ordinary phishing email.

Help Net Security08:00 UTC · 3h agoData breach in the wildCVE-2026-7273 CVE-2026-85102 CVE-2026-93616

Academic publisher Elsevier hit by LAPSUS$ redirect attack

Elsevier says a short-lived LAPSUS$ compromise redirected some visitors to a criminal leak page.

Elsevier confirmed that on September 21 visitors to some of its platforms were redirected to a LAPSUS$ leak page. The Amsterdam-based publisher said the compromise was narrowly scoped and brief, and that core platforms, customer data, research content, and operational systems were not compromised. Students reported the redirect on September 22 while trying to reach journals and textbooks. Elsevier operates ScienceDirect, ClinicalKey, and LeapSpace; it did not name the affected properties.

The Register · SecuritySep 23, 15:08 UTC · 3d agoData breach in the wild 3 sources

Elsevier Evolve, ClinicalPharmacology, and GSDD APIs Hijacked: LAPSUS$ Redirect Campaign

LAPSUS$ hijacked Elsevier education and clinical APIs, redirecting users to extortion splash pages.

Sorami Consulting reports that users and systems connecting to Elsevier Evolve, Sherpath, and ClinicalPharmacology are being redirected to extortion splash pages tied to LAPSUS$. The redirects point to domains including lapsus.ar.io and lapsus.bz. Public discussion describes nursing and medical students locked out of exams and simulation charting. The report also says GSDD APIs were hijacked in the same campaign.

DataBreaches.netupdated Sep 23, 15:08 UTC · 3d agofirst Sep 22, 21:30 UTC · 4d agoData breach in the wild 3 sources

Elsevier

Timeline3 articles

Related CVEsby mentions

Appears with

Week in review: Gyazo breach exposes 23.6M user data, TASK#STOMP steals documents

Academic publisher Elsevier hit by LAPSUS$ redirect attack

Elsevier Evolve, ClinicalPharmacology, and GSDD APIs Hijacked: LAPSUS$ Redirect Campaign