Orion S.A. Hit by $60 Million Business Email Compromise Scheme

j

Orion S.A., a leading global producer of carbon black, reported on August 10, 2024, that it had been targeted by a sophisticated Business Email Compromise (BEC) scheme, resulting in a significant financial loss.

According to a recent SEC filing, an employee, who is not a ‘Named Executive Officer,’ was deceived by cybercriminals into making multiple unauthorized wire transfers totaling approximately $60 million. These funds were sent to accounts controlled by unknown third parties. The company is now actively cooperating with law enforcement and exploring all available legal avenues, including insurance claims, to recover the lost funds.

BEC attacks are a type of cybercrime where attackers impersonate a trusted individual or organization, often through email, to manipulate employees into transferring money or sensitive information. In this case, the attackers likely used social engineering techniques to gain the trust of the Orion S.A. employee, leading to the fraudulent transfers. BEC schemes have become increasingly common and are known for targeting businesses of all sizes, exploiting human error rather than technical vulnerabilities.

In response to the incident, Orion S.A. has launched an internal investigation to assess the extent of the breach and to evaluate its internal controls. The company stated that, to date, there is no evidence of additional fraudulent activity or unauthorized access to its data or systems. Importantly, the incident has not disrupted Orion’s business operations. However, the investigation is ongoing, and the company is committed to strengthening its defenses to prevent future attacks.

Orion S.A., headquartered in Spring, Texas, is a major global supplier of carbon black, a critical material used in the production of tires, coatings, and various industrial rubber products. With a strong financial standing, Orion S.A. generates billions of dollars in revenue and holds a significant market position, particularly in the automotive industry. The company is publicly traded on the New York Stock Exchange under the ticker symbol “OEC” and operates manufacturing and research facilities worldwide.

The filing highlights the growing threat of BEC attacks and underscores the importance of robust cybersecurity measures and employee training to protect against such schemes.