Full Report
Customers got crime crew's calling card instead of access to journals
Analysis Summary
# Incident Report: Elsevier Web Redirection via LAPSUS$
## Executive Summary
Academic publishing giant Elsevier suffered a targeted cyberattack resulting in the unauthorized redirection of web traffic to a LAPSUS$ leak site. The incident primarily impacted students and researchers attempting to access textbooks and journals, who were met with a cybercriminal "calling card" instead of academic content. While the redirection was visible to users, Elsevier reports no compromise of core systems or customer data.
## Incident Details
- **Discovery Date:** September 22, 2026 (via public reports/Reddit)
- **Incident Date:** September 21, 2026
- **Affected Organization:** Elsevier
- **Sector:** Academic Publishing / Information Analytics
- **Geography:** Global (Headquartered in Amsterdam, Netherlands)
## Timeline of Events
### Initial Access
- **Date/Time:** September 21, 2026
- **Vector:** Likely DNS hijacking or unauthorized modification of web server configurations (Specifics not disclosed by Elsevier).
- **Details:** Attackers gained enough access to manipulate traffic routing for "select platforms."
### Lateral Movement
- **Details:** Elsevier reports the incident was "narrowly scoped," suggesting the attackers did not successfully pivot from the web-facing redirection point into the core internal network or databases.
### Data Exfiltration/Impact
- **Details:** No evidence of data exfiltration (research content or customer PII). The primary impact was loss of availability and brand damage.
### Detection & Response
- **Detection:** Identified on September 21, 2026, by Elsevier’s security team; corroborated by student reports on social media on September 22.
- **Response Actions:** The cybersecurity team immediately resolved the redirection and restored normal traffic flow to the affected properties.
## Attack Methodology
- **Initial Access:** Redirection attack (potentially via DNS tampering, CDN compromise, or web server unauthorized access).
- **Persistence:** None reported; the event was described as "limited-duration."
- **Defense Evasion:** Use of legitimate third-party leak sites to host the redirection target.
- **Impact:** Website Defacement/Redirection (Traffic Hijacking).
## Impact Assessment
- **Financial:** Minimal direct costs; potential loss of productivity for subscribing institutions.
- **Data Breach:** None reported. Core platforms and customer data remained secure.
- **Operational:** Temporary disruption to "homework and textbooks" access for students and medical professionals.
- **Reputational:** Significant; the visibility of the LAPSUS$ brand on an academic platform caused public concern and "creepy" user experiences.
## Indicators of Compromise
- **Network Indicators:** Redirection to LAPSUS$ leak site (URL: `https[:]//www[.]reddit[.]com/r/cybersecurity_help/comments/1wmunv6/what_the_heck_is_lapsus_group/` - *Note: Link contains screenshot of the destination*).
- **Behavioral Indicators:** Users attempting to reach Elsevier domains were automatically routed to a non-Elsevier IP address hosting LAPSUS$ branding.
## Response Actions
- **Containment:** Identified the specific platforms/subdomains being redirected and revoked unauthorized changes.
- **Recovery:** Restored normal service and validated the integrity of ScienceDirect and ClinicalKey platforms.
- **Eradication:** Elsevier stated the issue was "resolved" by their cybersecurity team shortly after identification.
## Lessons Learned
- **Monitoring Matters:** Public sentiment and social media (Reddit) served as a secondary detection layer for user-facing issues.
- **Third-Party/Edge Security:** Even if core databases are secure, vulnerabilities in the delivery layer (DNS/CDN) can lead to significant reputational damage.
- **Scope Limitation:** Maintaining strict segmentation between web-facing redirection logic and core research databases prevented a minor incident from becoming a catastrophic data breach.
## Recommendations
- **DNS Security:** Implement DNSSEC and registry locks to prevent unauthorized redirection of domain names.
- **Access Management:** Audit and enforce Multi-Factor Authentication (MFA) for all administrative accounts related to web infrastructure, CDN providers, and domain registrars.
- **Integrity Monitoring:** Deploy automated tools to monitor for unauthorized changes to web server configurations and unexpected traffic patterns.