Snapshot 216805
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Trust Center Start your security review View & download sensitive information Ask for information Overview Elsevier is a global leader in information and decision support for science and healthcare. We support researchers, clinicians and other impact makers with trusted, evidence-based content and AI-enabled digital technologies. Our Commitment to Security As part of our responsibility to the communities we serve, we treat information security as a fundamental enabler of progress, helping protect the availability, confidentiality and integrity of the data and systems under our care. We maintain compliance with leading security and privacy frameworks and hold certifications such as ISO 22301:2019, ISO 27001:2022, and ISO 27701:2019. We conduct regular audits and independent assessments to help validate our controls, and we use secure infrastructure designed for all users. Our team continually updates security practices to reflect evolving procedures, regulations and threats so we can keep improving over time. Key Security Measures Defense in Depth Controls: We deploy multiple layers of network security capabilities Data Encryption: Data is encrypted both in transit (using TLS 1.2 or higher) and at rest (using AES-256) Logging and Detection Systems: We utilize detailed logging and advanced detection systems 24x7x365 SOC: We utilize detailed logging and advanced detection systems Responsible AI and Privacy Protections Elsevier is committed to responsible AI use and protecting user data privacy in our AI solutions. We treat user inputs and data in line with our Privacy Policy and our Responsible AI principles, including applicable privacy laws such as GDPR and CCPA. For each use case and solution, we select the most appropriate large language model from a carefully chosen range of leading providers and host them securely in trusted environments. We pride ourselves on never using customer data to train our models: our enterprise agreements include zero-retention contracts, so prompts and documents are never used for large language model development. These controls and practices are designed to help protect the information and the users we support throughout the service lifecycle. Compliance ISO/IEC 27001:2022 ISO/IEC 27017:2015 ISO/IEC 27701:2019 ISO/IEC 27018:2019 ISO 22301:2019 ISO 13485:2016 ISO/IEC 42001:2023 GDPR CCPA CSA STAR Level 1 Cyber Essentials Plus EU AI Act FERPA HIPAA SOX TX-RAMP VPAT WCAG Documents REPORTSApplication Pentest Attestation REPORTSSecurity Whitepaper COMPLIANCECSA STAR Level 1 COMPLIANCEISO 13485:2016 COMPLIANCEISO 22301:2019 COMPLIANCEISO/IEC 27001:2022 COMPLIANCEISO/IEC 27017:2015 COMPLIANCEISO/IEC 27018:2019 COMPLIANCEISO/IEC 27701:2019 COMPLIANCETX-RAMP SELF-ASSESSMENTSCAIQ SELF-ASSESSMENTSHECVAT Full Corporate Security Asset Management Practices Email Protection Employee Training View more AI AI Overview AI Security AI Monitoring View more Product Security Audit Logging Data Security Integrations View more App Security Application Penetration Testing Code Analysis Credential Management View more Network Security Bot Detection Data Loss Prevention Distributed Denial of Service Protection (Anti-DDoS) View more Infrastructure Status Monitoring Anti-DDoS BC/DR View more Data Privacy Privacy Principles Privacy ISO Certification Usage Data View more Data Security Certificates of Destruction Data Asset Classification Data Backups View more Risk Profile AWSMajor Cloud Provider Access Control Access Log Management Automated Account Management Data Access View more Legal Subprocessors Customer Audit Rights Cyber Insurance View more Self-Assessments CAIQ HECVAT Full Reports Application Pentest Attestation Security Whitepaper ESG Anti-Bribery and Corruption Anti-Competitive Practices Anti-Modern Slavery View more Endpoint Security Anti-Malware Disk Encryption Endpoint Detection & Response View more Policies AI System Development and Evaluation Policy Asset Authorization and Monitoring Policy Asset Management Policy View more Continuous Monitoring Data Loss Prevention System (DLP) Event & Audit Log Management File Integrity Monitoring (FIM) View more Incident Response Designated Response Personnel Incident Reporting Process Security Operations Center (SOC) Security Grades BitSight BitSight 710 RiskRecon RiskRecon 8.1 Risk Management Data Access/Impact Levels Risk Assessments Supply Chain Risk Management View more Asset Management Asset Classification Asset Inventories (Hardware/Software) Asset Tracking View more Training Employee Privacy Training Phishing Training Role-Based Training View more Change Management Change Advisory Board (CAB) Change Control Board (CCB) Change Management Program View more BC/DR Business Continuity Plan (BCP) Data Backup/Backup Protection Disaster Recovery Plan (DRP) Physical & Environment Access Monitoring Alarms & Surveillance Emergency Power & Lighting View more Trust Center Updates Update on recently disclosed PHP vulnerabilities General On October 21, 2026, the PHP project released security updates for two critical vulnerabilities in PHP, software widely used to run web services. We are actively managing our response and have no indication that our systems or customer data have been compromised by these vulnerabilities. We are assessing our environment, applying patches and added protective controls, monitoring for suspicious activity, and confirming the status of our suppliers' systems. You may notice reduced availability while we apply updates, and we will give advance notice of interruption to services where possible. If you have questions, please contact security@elsevier.com. Elsevier Website Issue Update Incidents On September 21, visitors to select Elsevier sites were redirected to a third-party page. Our teams responded immediately, resolving the issue and restoring normal service. This was initiated via a compromised credential, which has since been deprecated and replaced. There is no evidence that core platforms, customer data, research content, or operational systems were compromised. There was no indication of credential harvesting, data exfiltration, or lateral movement. As an additional level of assurance, we have engaged independent external experts to validate our findings, review the effectiveness of the actions taken, and confirm that appropriate measures remain in place to manage any residual risk. Based on our investigation, remediation efforts, ongoing monitoring, and independent validation activities, we are confident that the impact was limited, contained, and effectively addressed. October 16, 2026 Update: Our external forensic firm has reviewed extensive logs and system artifacts provided by our teams and confirmed the following: The unauthorized activity was limited to an approximately fifteen-minute window on September 21. There was no evidence of access to Elsevier infrastructure or product platforms. There was no evidence of exfiltration of Elsevier system data, sensitive information, or customer data. There was no unauthorized activity outside of the approximately fifteen-minute window. These findings are consistent with our own investigation and with the remediation actions already taken, including the deprecation and replacement of the compromised key. We are confident that the impact was limited, contained, and effectively addressed.