Elsevier Domains Hijack Lapsus

Three domains / web portals belonging to Dutch academic publishing company Elsevier have been redirecting users to a page branded “LAPSUS$ GROUP, Chapter II,” carrying a signed statement that taunted the FBI and counted down to a future victim.

According to Cloudskope researchers, the redirect ran for at least 78 minutes, from roughly 7:49pm CT until it was cleared before 10:09pm CT on September 21, 2026.

Elsevier is yet to offer an explanation on how it happened or say whether users should worry their login credentials or other data having been stolen, but the affected domains and portals have been “cleaned” and are accessible and functional again.

The three “hijacked” Elsevier domains were:

Elsevier.com (the main company website)

Evolve.elsevier.com (a login portal and learning management system for nursing and health-professions education)

Submit.elsevier.com (a portal where researchers upload manuscripts for peer review)

Users were redirected to a page showing the following notice:

Cloudskope researchers believe the redirect was effected “with a change at the DNS or CDN edge: a DNS record, a CDN redirect rule, or the account that manages them.”

“A Chinese-language forum post claims the actor altered Elsevier’s Cloudflare redirect rules. We could not verify that,” they added .

We’ve reached out to Elsevier with questions what happened, and we’ll update this item if we receive a .

Lapsus$ Group, known for its extortion-focused attacks against large tech companies like Microsoft, Okta , Nvidia and Uber , is believed to have been inactive since late 2022, following the arrests and convictions of some of its members.

Still, some of the remaining members possibly joined the Scattered Lapsus$ Hunters collective in 2025, which continued with high-profile data breaches and extortion attempts.

However, in 2026, a Lapsus$-branded leak site named new victim organizations: US healthcare firm Virta Health, Vodafone Germany, AYA Bank, and others.

This latest statement seems to imply that the group is back and strong, and plans to target (or has targeted already) a “global company generating over $50 billion in annual revenue, with operations and a strong presence worldwide.”

Whether this claim is true or not, remains to be seen.

Securonix researchers, who analyzed the same page earlier this month, said that “none of the evidence reviewed so far establishes personnel continuity with the original 2021-2022 LAPSUS$ cluster.”

UPDATE (September 23, 2026, 03:20 a.m. ET):

“On September 21, Elsevier identified that visitors to select platforms were being redirected to a third-party page. Our cybersecurity team responded immediately, resolving the issue and restoring normal service,” an Elsevier spokesperson told Help Net Security.

“Our investigation indicates that this was a narrowly scoped, limited-duration event involving the temporary redirection of traffic for certain web properties. There is no indication that core platforms, customer data, research content, or operational systems were compromised.”

OpenAI agent hacking spree widens to Australia, targeting government website

New Android malware RemControl steals banking PINs and blocks removal attempts

What to do first when you get 90 days to secure AI agent data

Download: The High-Performance Team Playbook

Simplify security management with CIS SecureSuite Platform

Download: The IT and security field guide to AI adoption

OpenAI agent hacking spree widens to Australia, targeting government website

New Android malware RemControl steals banking PINs and blocks removal attempts

What to do first when you get 90 days to secure AI agent data

Your security program knows the firewall, but does it know the elevator?

DarkMe RAT trades zero-days for plain phishing emails