As cited
Copy frozen at (site build).
breaches incidents
Brief hijack makes Elsevier domains redirect to LAPSUS$ “Chapter II” page
Three Elsevier domains were redirected to a page claiming to be from LAPSUS$ GROUP, Chapter II for at least 78 minutes on September 21, 2026. The redirect displayed a statement taunting the FBI and referenced a countdown to a future victim. Elsevier has not yet disclosed how the hijack occurred or what corrective measures were taken.
Why it matters: Organizations using Elsevier services faced potential credential harvesting or malware delivery during the incident, and practitioners should assess whether their users accessed these domains and monitor for suspicious activity from that timeframe.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
breaches incidents
Brief hijack makes Elsevier domains redirect to LAPSUS$ “Chapter II” page
Three Elsevier domains were redirected to a page claiming to be from LAPSUS$ GROUP, Chapter II for at least 78 minutes on September 21, 2026. The redirect displayed a statement taunting the FBI and referenced a countdown to a future victim. Elsevier has not yet disclosed how the hijack occurred or what corrective measures were taken.
Why it matters: Organizations using Elsevier services faced potential credential harvesting or malware delivery during the incident, and practitioners should assess whether their users accessed these domains and monitor for suspicious activity from that timeframe.
- Source published
- First seen by Cybersecurity Tracker