Brief hijack makes Elsevier domains redirect to LAPSUS$ “Chapter II” page
Three Elsevier domains, including manuscript portal submit.elsevier.com, redirected for 78 minutes to a LAPSUS$ extortion page taunting the FBI.
On September 21, 2026, elsevier.com, evolve.elsevier.com and submit.elsevier.com redirected to a page branded 'LAPSUS$ GROUP, Chapter II' carrying a signed statement mocking the FBI and counting down to a future victim. Cloudscope researchers say the redirect ran at least 78 minutes (7:49pm to before 10:09pm CT) and was likely caused by a DNS record, CDN redirect rule, or management-account change; a Chinese forum post claiming altered Cloudflare redirect rules could not be verified. Elsevier has offered no explanation or statement on possible credential theft. Securonix found no evidence of personnel continuity with the original 2021-2022 LAPSUS$ cluster, though a 2026 LAPSUS$-branded leak site named Virta Health, Vodafone Germany and AYA Bank.
- 78-minute redirect of elsevier.com, evolve.elsevier.com, submit.elsevier.com on September 21, 2026
- Suspected cause: DNS record, CDN redirect rule, or compromised management account
- Elsevier has not explained incident or addressed possible credential theft
- Securonix finds no confirmed continuity with original 2021-2022 LAPSUS$ actors
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | elsevier.com | ffected domains The three “hijacked” Elsevier domains were: Elsevier.com (the main company website) Evolve.elsevier.com (a login por |
| domain | evolve.elsevier.com | evier domains were: Elsevier.com (the main company website) Evolve.elsevier.com (a login portal and learning management system for nursing |
Full article409 words · extracted from helpnetsecurity.com · click to collapse
Three domains / web portals belonging to Dutch academic publishing company Elsevier have been redirecting users to a page branded “LAPSUS$ GROUP, Chapter II,” carrying a signed statement that taunted the FBI and counted down to a future victim.
According to Cloudscope researchers, the redirect ran for at least 78 minutes, from roughly 7:49pm CT until it was cleared before 10:09pm CT on September 21, 2026.
Elsevier is yet to offer an explanation on how it happened or say whether users should worry about their login credentials or other data having been stolen, but the affected domains and portals have been “cleaned” and are accessible and functional again.
The affected domains
The three “hijacked” Elsevier domains were:
- Elsevier.com (the main company website)
- Evolve.elsevier.com (a login portal and learning management system for nursing and health-professions education)
- Submit.elsevier.com (a portal where researchers upload manuscripts for peer review)
Users were redirected to a page showing the following notice:
Cloudscope researchers believe the redirect was effected “with a change at the DNS or CDN edge: a DNS record, a CDN redirect rule, or the account that manages them.”
“A Chinese-language forum post claims the actor altered Elsevier’s Cloudflare redirect rules. We could not verify that,” they added.
We’ve reached out to Elsevier with questions about what happened, and we’ll update this item if we receive a reply.
A revived brand
Lapsus$ Group, known for its extortion-focused attacks against large tech companies like Microsoft, Okta, Nvidia and Uber, is believed to have been inactive since late 2022, following the arrests and convictions of some of its members.
Still, some of the remaining members possibly joined the Scattered Lapsus$ Hunters collective in 2025, which continued with high-profile data breaches and extortion attempts.
However, in 2026, a Lapsus$-branded leak site named new victim organizations: US healthcare firm Virta Health, Vodafone Germany, AYA Bank, and others.
This latest statement seems to imply that the group is back and strong, and plans to target (or has targeted already) a “global company generating over $50 billion in annual revenue, with operations and a strong presence worldwide.”
Whether this claim is true or not, remains to be seen.
Securonix researchers, who analyzed the same page earlier this month, said that “none of the evidence reviewed so far establishes personnel continuity with the original 2021-2022 LAPSUS$ cluster.”
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!