Academic publisher Elsevier says attackers briefly tampered with some of its web properties so visitors were sent to a LAPSUS$ extortion page instead of the normal site. Elsevier said it detected the issue on September 21, responded immediately, and restored service, calling it a narrowly scoped and limited-duration traffic redirection event. The company said it has no indication that customer data, research content, core platforms, or operational systems were compromised, but it has not identified all affected platforms publicly.
Why it matters: Elsevier runs widely used academic and clinical information services, so even a short-lived compromise can disrupt students, researchers, and healthcare users and may indicate risk to trust in those platforms. Organizations and users relying on Elsevier should watch for follow-up disclosures, verify links carefully, and be alert for any phishing or credential prompts tied to this incident.
2026.09.23
100% relevant
This article appears to be the first concrete report in the set of Elsevier confirming a specific September 2026 compromise involving malicious redirection to a LAPSUS$ page.
← Back to all stories