{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2024-orion-s-a-discloses-60-million-loss-from-fraudulently-induced-wire-trans"},"incident":{"title":"Orion S.A. discloses $60 million loss from fraudulently induced wire transfers","date":"2024-08-10","date_precision":"day","victim_org":"Orion S.A.","sector":"Manufacturing","country":"United States","primary_vector":"Business Email Compromise","secondary_vectors":[],"ai_involvement":"Unknown","ai_notes":"The company's SEC filing did not describe the impersonation technique or state whether AI-generated media was involved.","outcomes":["Wire Fraud / Financial Loss"],"loss_usd":60000000,"loss_note":"Approximately $60 million one-time pre-tax charge for unrecovered fraudulent transfers, per the company's Form 8-K. Orion said it would pursue recovery including through insurance.","records_affected":null,"threat_actor":null,"summary":"Chemicals maker Orion S.A. disclosed in a Form 8-K filed August 12, 2024 that on August 10, 2024 it determined an employee who is not a named executive officer had been targeted by a criminal scheme resulting in multiple fraudulently induced outbound wire transfers to accounts controlled by unknown third parties. The company expected to record a one-time pre-tax charge of roughly $60 million for unrecovered funds and said it would pursue recovery, including through available insurance.","how_it_worked":"The disclosure describes the standard structure of a corporate payment-diversion fraud: a single employee inside the payments process was deceived into initiating a series of outbound wires rather than one large transfer, which keeps individual amounts within familiar approval bands and spreads them across banking cutoffs. The recipients were accounts controlled by unidentified third parties, consistent with mule networks that disperse funds quickly across jurisdictions. Orion identified the scheme after the transfers had been executed, concluded the loss was unrecoverable enough to book a $60 million charge, and reported that its systems and financial reporting controls were otherwise unaffected, indicating deception of a person rather than a technical compromise.","lessons":"Payment initiation by a single employee is a structural weakness; enforced dual authorization plus out-of-band verification and velocity alerting on new beneficiaries would have interrupted the sequence.","confidence":"Confirmed","sources":[{"title":"Orion S.A. Form 8-K, Item 8.01 (filed August 12, 2024)","url":"https://www.sec.gov/Archives/edgar/data/1609804/000095014224002170/eh240519238_8k.htm","publisher":"U.S. Securities and Exchange Commission (EDGAR)"},{"title":"Scammers dupe chemical company into wiring $60 million","url":"https://www.helpnetsecurity.com/2024/08/13/orion-fraudulent-wire-transfers-60-million/","publisher":"Help Net Security"}],"entry_type":"incident","slug":"2024-orion-s-a-discloses-60-million-loss-from-fraudulently-induced-wire-trans","year":2024,"loss_kind":"direct_loss","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2024-orion-s-a-discloses-60-million-loss-from-fraudulently-induced-wire-trans"}}