Brief hijack makes Elsevier domains redirect to LAPSUS$ “Chapter II” page (2 minute read)

2026-09-25

Elsevier domains (Elsevier.com, Evolve.elsevier.com, Submit.elsevier.com) were briefly hijacked on September 21, redirecting users to a LAPSUS$ 'Chapter II' page for over an hour. Suspected causes include DNS, CDN redirect, or management account compromise. Elsevier restored service, reporting no compromise of core platforms, customer data, or operational systems.