Elsevier domains briefly redirected to LAPSUS$ "Chapter II" page

Three Elsevier domains and portals redirected users to a page branded "LAPSUS$ GROUP, Chapter II" for at least 78 minutes, from about 7:49pm to before 10:09pm CT on September 21, 2026. Cloudscope researchers believe the redirect was done via a DNS or CDN edge change. Elsevier has not explained the incident or said whether login credentials were compromised.

• Redirect lasted at least 78 minutes on September 21, 2026
• Evolve.elsevier.com and Submit.elsevier.com were affected
• Cloudscope: likely a DNS record or CDN redirect rule change
• LAPSUS$ claimed a target with over $50B in annual revenue