Elsevier faces cyber security incident after users redirected to LAPSUS$ page

Elsevier confirmed suffering a security incident after thousands of students reported being redirected to a cyber criminal’s leak page.

Headquartered in Amsterdam, Elsevier is a leading global STM academic publisher and a key subsidiary of RELX Group. It provides digital access to thousands of journals and millions of research articles, supporting researchers worldwide. The company employs around 1,560 people across five UK sites, including a technology hub in London.

Recently, several students reported being redirected to the LAPSUS$ leak site while attempting to access their homework and textbooks.

“I know nothing about cyber security, I’m just a nursing student trying to log in to Elsevier to access my homework and textbooks. Every time I try to open the Elsevier website, I am met with this. Anyone know anything or have any explanation??,” one student posted on social media.

Affected properties included elsevier.com, evolve.elsevier.com and submit.elsevier.com. According to Cloudskope, an independent cybersecurity risk and technology advisory firm, the affected sites were directly issuing HTTP 302 redirects that remained active for at least 78 minutes. The redirects led to a pre-existing LAPSUS$ “Chapter II” extortion page rather than a page specifically created for Elsevier.

Acknowledging the reports of a data security incident, in a statement shared with media, a Elsevier spokesperson said, “On September 21, Elsevier identified that visitors to select platforms were being redirected to a third-party page. Our cybersecurity team responded immediately, resolving the issue and restoring normal service.

“Our investigation indicates that this was a narrowly scoped, limited-duration event involving the temporary redirection of traffic for certain web properties. There is no indication that core platforms, customer data, research content, or operational systems were compromised,” the spokesperson added.