Elsevier.com, Evolve and Manuscript Submission Redirected to LAPSUS$ for at Least 78 Minutes

Updated September 22, 2026, 8:30pm CT. All Elsevier domains resolve normally; we re-checked tonight. Elsevier has now given its first public comment, a four-sentence statement to DataBreaches.net published at 12:30pm CT. It does not say how the redirect happened, when it began or ended, or what users who signed in during the window should do. Independent analysis has established that the page was staged three weeks in advance and that it delivered no payload.

Full analysis now published: Elsevier Was the Name on the Page. RELX Was the Pattern. connects the FBI's July warning on TeamPCP, the August arrests, the February breach of LexisNexis, and what RELX has told its shareholders about either.

For at least 78 minutes on the evening of September 21, Elsevier's own homepage served an extortion page. Typing www.elsevier.com landed visitors on a site branded LAPSUS$ GROUP, Chapter II, carrying a signed statement that taunted the FBI and counted down to a future victim. It was not a lookalike domain and not a phishing email. The real address went to the attacker's page.

Two other Elsevier properties did the same: submit.elsevier.com, where researchers upload manuscripts for peer review, and evolve.elsevier.com, the platform American nursing programs use for HESI exams and coursework. ScienceDirect was unaffected throughout.

This was not ransomware. Nothing was encrypted and no Elsevier data has been claimed by anyone. What is confirmed is narrower and, in one specific way, worse: for the length of that window, someone else controlled where Elsevier's traffic went.

Elsevier is a Dutch academic publisher owned by RELX and one of the largest scientific publishers in the world. Almost nobody chooses to use it. Their university did, or their hospital did, or their nursing program did.

Who depends on the three affected domains

• Nursing students and programs. Evolve is where American nursing programs run HESI exams, Sherpath coursework, adaptive quizzing and post-exam remediation. A student who cannot reach Evolve cannot sit a required exam.
• Researchers submitting papers. submit.elsevier.com is the front door for manuscript submission to Elsevier journals.
• Everyone visiting the company itself. Customers, librarians, authors, job applicants, press.

The scale behind those domains

Elsevier does not publish a customer list, but its own reported figures give the scale. These are the company's numbers, not ours:

• 24,700+ institutions served across academic, industry and government
• ~3,000 journals, including The Lancet and Cell, accounting for roughly 18% of global research output
• 20+ million monthly unique visitors to ScienceDirect
• 5,500 hospitals and medical schools in 80+ countries using ClinicalKey
• 500,000+ course enrollments on Sherpath, the health-professions platform delivered through Evolve
• 4.5 million registered users of Complete Anatomy across 650+ medical schools
• 9,500 employees across 170+ countries

Those customers are universities, teaching hospitals, nursing schools, government research agencies and corporate R&D. Almost none can switch on short notice. Scopus, Elsevier's citation database, is what many institutions and governments use to decide which journals count toward tenure and funding.

How the evening unfolded (Central Time, September 21)

• ~7:49pm. A Chinese-language forum post reports submit.elsevier.com and Elsevier journal links redirecting to a LAPSUS$ domain, and claims the actor altered Elsevier's Cloudflare redirect rules.
• 7:57pm. A nursing student following an evolve.elsevier.com link lands on the LAPSUS$ page. Cloudskope has the screen recording.
• 8:17pm. Cloudskope confirms submit.elsevier.com and evolve.elsevier.com both redirect. sciencedirect.com loads normally.
• 8:29pm. www.elsevier.com also redirects.
• 8:33pm. Still live. This entry is published.
• 9:07pm. All three domains still return an HTTP 302 redirect to the LAPSUS$ page. No statement, no press coverage.
• 10:09pm. Redirect cleared. All three domains resolve normally. The reversal happened at some point between 9:07pm and 10:09pm and was not announced.
• September 22, 12:30pm. DataBreaches.net publishes a four-sentence statement from Elsevier, the company's first public comment. The same report relays a third-party claim that ClinicalPharmacology and the Gold Standard Drug Database authentication API were also redirected; see below.
• September 22, 8:30pm. Cloudskope re-checks all domains. Normal. No notice on the Elsevier press page or, per DataBreaches.net, on Evolve.

What visitors saw

A PGP-signed statement announcing the group's return from "retirement," taunting the FBI, and thanking another group, "TeamPCP," for providing "coverage." It listed Virta Health as a disclosed victim marked "Data Published," and ran a countdown to an unnamed upcoming target described as a global company with more than $50 billion in annual revenue. RELX's revenue is well below that figure, so the countdown most likely points elsewhere.

Elsevier's response

Nothing for roughly sixteen hours. Then, on September 22, a statement provided to DataBreaches.net and published at 12:30pm CT:

"On September 21, Elsevier identified that visitors to select platforms were being redirected to a third-party page. Our cybersecurity team responded immediately, resolving the issue and restoring normal service. Our investigation indicates that this was a narrowly scoped, limited-duration event involving the temporary redirection of traffic for certain web properties. There is no indication that core platforms, customer data, research content, or operational systems were compromised."

That is the entire public account. It gives no start time, no end time and no mechanism. It does not tell anyone who typed a password into an Elsevier login form during the window what to do. "No indication" describes what an investigation has not found; it says nothing about what the account that changed the routing was able to reach. As of this update there is no notice on Elsevier's press page or, per DataBreaches.net, on the Evolve site.

The open question is unchanged. A redirect that is quietly fixed and then described in four sentences leaves every affected student, author and institution unable to answer the only thing they need to know: whether the credentials they typed went somewhere they should not have.

Confirmed by direct observation

• www.elsevier.com, submit.elsevier.com and evolve.elsevier.com each returned an HTTP 302 redirect to an external page branded LAPSUS$.
• sciencedirect.com was unaffected at every check.
• The redirect was verified live at 8:17pm, 8:29pm, 8:33pm and 9:07pm CT on September 21, and found cleared at 10:09pm CT.
• The page named one prior victim, Virta Health, and that breach was real. Virta confirmed unauthorized access to a data repository in March 2026 and reported 14,636 affected individuals.

What independent analysis has since established

Securonix published a technical assessment of the "Chapter II" page on September 14, a week before the Elsevier redirect. Three findings from it matter here.

The page was staged weeks in advance. The Arweave name was leased on August 30, a small test object appeared shortly afterward, and the final 10,977-byte page was anchored on September 2. Elsevier's domains were pointed at infrastructure that had been sitting ready for nearly three weeks.

The page carried no payload. Securonix assessed it as "a static extortion announcement rather than a loader or payload-delivery page." Anyone who merely loaded the page during the window was not served malware.

The signature is real, but it does not identify anyone. The PGP signature validates against the published key, which confirms that whoever holds the private key signed the statement. Securonix holds low confidence that the operators are the original 2021-2022 crew, concluding that the evidence "supports continuity of persona and narrative more strongly than continuity of personnel."

That last point is a correction to the intuitive reading. The destination being an established LAPSUS$ leak site does not mean the original LAPSUS$ members did this. The brand may have been picked up by other operators.

Still unverified

• Whether any Elsevier data was taken. None has been claimed. Absence of a claim is not evidence of absence.
• How routing control was obtained. A Chinese-language forum post claims the actor altered Elsevier's Cloudflare redirect rules. We could not verify that.
• Who operated the page. The signature is cryptographically valid, but identity behind the key is unestablished.
• Whether the login pages collected anything. The destination page delivered no payload, but that does not address what happened to credentials typed into an Elsevier login form that had been pointed elsewhere. Only Elsevier can answer that.
• Exactly when and how the redirect was reversed. The clearing happened between 9:07pm and 10:09pm CT with no announcement. Elsevier's statement gives no times.
• Whether clinical drug-reference APIs were also redirected. DataBreaches.net relays a LinkedIn post by Sorami Consulting claiming that ClinicalPharmacology and the authentication endpoint of Elsevier's Gold Standard Drug Database, api.gsdd.net, were redirecting token requests during the window. We did not test those endpoints on September 21 and cannot confirm it. If accurate, the incident reached drug-information services used by hospital systems, not only publishing and education.

What the pattern indicates

This maps to MITRE ATT&CK T1584.001, Compromise Infrastructure: Domains, which covers hijacking a victim's domains or subdomains through registrar or DNS-provider account access. The usual precursor is T1078, Valid Accounts.

It was not DNS cache poisoning. Poisoning corrupts a resolver's cache and decays on TTL. This was authoritative and consistent across networks for the duration of the window.

Three properties spanning corporate, publishing and education failed together while ScienceDirect, hosted separately, did not. That points to a single compromised control plane rather than three separate intrusions, and it is consistent with a change at the DNS or CDN edge: a DNS record, a CDN redirect rule, or the account that manages them.

Cloudskope will not link to the extortion page or the archive it hosted.

For sponsors holding publishing, edtech or information-services assets, this incident is a reminder that DNS, CDN and registrar accounts belong in the diligence scope. They are rarely inventoried, often held by a single administrator, and a single compromise can put an attacker's page on the company's primary domain within minutes.