TL;DR
- 01What happened
In August 2024, carbon black maker Orion S.A. told the US SEC that an employee who is not a named executive officer had been targeted by a criminal scheme, and that multiple fraudulently induced wire transfers had gone to accounts controlled by unknown third parties. It booked a $59.2 million loss for unrecovered transfers in the third quarter and recovered $9.2 million in 2025; most has not come back.
- 02What is known
Orion has not disclosed the method. The press calls it business email compromise; the company’s filings do not. What is known: Orion reported a material weakness in its manual wire controls, which it believed were adequate as designed to prevent or detect unauthorized transfers but which did not operate effectively.
- 03The missing layer
Orion identified the problem on August 10, after the transfers had already gone out. What failed was the layer that ties each transfer to a verified request.
What happened
- Party
- Orion S.A., a carbon black maker. Incorporated in Luxembourg; principal executive offices in Spring, Texas, per its SEC filings. Listed on the NYSE.
- What happened
- On August 10, 2024, Orion determined that an employee who is not a named executive officer had been the target of a criminal scheme that resulted in multiple fraudulently induced outbound wires to accounts controlled by unknown third parties (8-K of August 12).
- Loss
- $59.2 million booked in Q3 2024 for unrecovered transfers; $55.7 million net of recoveries in the 2024 annual report. $9.2 million (€7.9 million) recovered in 2025. Investigation fees were $3.6 million in 2024 and $2.3 million in 2025.
- Systems
- No unauthorized access to data or systems was found, and operations were not affected.
- Not disclosed
- The method (email, phone, who was impersonated). The total, number and dates of the transfers, and the destination countries. Whether the fraudulent transfers themselves were manual (the material weakness concerned controls over manual wires). The targeted employee’s role. Which site was involved. The press calls it business email compromise; the filings do not use the term.
Glossary
Orion S.A. — A maker of carbon black, a raw material for tires and plastics. Incorporated in Luxembourg, with principal executive offices in Texas. Listed on the New York Stock Exchange.
Form 8-K — A filing US-listed companies make with the SEC to report significant events as they happen.
Material weakness — A deficiency in internal control over financial reporting serious enough that a material misstatement may not be prevented. Listed companies must disclose it.
As far as disclosed, events ran as follows.
The stopping point is ②. Had each transfer been tied to a verified request, a deceived request would not produce the transfers in ③. The method in ① has not been disclosed.
Method not disclosed.
The company believes its manual wire controls were adequate as designed.
Q3 2024. $59.2M booked as unrecovered.
August 10. Pursues recovery, including insurance.
Timeline — disclosure and response
- Orion determines an employee was targeted and multiple wires went to third-party accounts.
- Files an 8-K, expecting a charge of about $60 million absent further recoveries.
- The Q3 report books a $59.2 million loss and discloses a material weakness in manual wire controls, concluding disclosure controls were not effective at September 30.
- The 2024 annual report puts the loss at $55.7 million net of recoveries and says the weakness was remediated by year-end.
- The 2025 annual report discloses a $9.2 million recovery.
The facts rely on Orion’s SEC filings (the 8-K, the Q3 2024 10-Q, and the 2024 and 2025 10-Ks; all primary). The “business email compromise” label comes from the press; the company has not confirmed it.
After disclosure
- Orion: Added controls over cash disbursements, strengthened management’s quarterly sub-certifications, expanded employee training and encouraged early escalation. The audit committee engaged a third party to investigate. At December 31, 2024, the company concluded the controls had operated long enough to call the weakness remediated.
- Recovery: Working with law enforcement and pursuing recovery through all legal means, including insurance.
Why it wasn’t stopped
The failure was not missing controls on paper. Wire controls the company believed adequate as designed did not operate, and nothing tied each transfer to a verified request.
The company reported that it believed its manual wire controls were adequate as designed to prevent or detect unauthorized transfers, but that they did not operate effectively. No mechanism tying each transfer to a verified request is visible in the disclosures.
Proof here means checking, before a manual wire goes out, that it is tied to a request verified as genuine, and keeping a record. Detection means noticing fraud after the transfers.
unrecovered
Orion identified the problem on August 10 and moved to recover funds, but the wires had already gone out. As long as a control depends on people following steps, a deceived person following those steps produces transfers that look compliant. That distance is the gap between detection and proof, and it is structural.
The same structure appears in the Hong Kong deepfake meeting fraud (a finance employee made 15 transfers on a faked CFO’s instruction).
How to counter this
Execute a manual wire only when it is tied to a request verified as genuine. Verification should not rest on the judgment of the person sending; it should be done by a means separate from the requester, and its result tied to the transfer. Then a deceived employee following the steps still cannot send money on an unverified request. It sits in front of detection, not in place of it.
Industries and operations to watch
- IndustryManufacturing
- Companies with many overseas sites and suppliers that make cross-border transfers by hand.
- OperationApproval
- Manual wires made by staff on request, and their approval.
- OperationBank account changes
- Transfers to first-time recipients, or to new accounts named in a hurry.
Do today’s controls close it?
| Control | This case | Why |
|---|---|---|
| Wire approval steps | Partial | The company believes they were adequate as designed, but says they did not operate. |
| Management sub-certifications | Ineffective | Quarterly reviews act after the fact, not before a transfer. |
| Employee training | Partial | Makes deception harder, but does not stop a deceived employee’s steps. |
| Recovery and insurance | Ineffective | After-the-fact remedies that do not stop the transfer. Part was recovered by 2025. |
- Verify wire requests by a means separate from the requester. Do not verify inside the channel the request came in on.
- Make it impossible to execute a wire not tied to a verified request. Even manual wires cannot go without a verification result.
- Record which request was paid, and how it was verified. Keep it as proof with every transfer, rather than waiting for quarterly after-the-fact reviews.
Three things to confirm about manual wires
- Is there any path for manual wires outside the system’s payment flow?
- Is there a step to verify a wire request by a means other than the one it arrived on?
- Can one employee’s judgment alone send several wires in a short time?
Note: if the requester’s own channels are compromised, this check can be passed. And because the method has not been disclosed, this Brief limits itself to countermeasures that work whatever the route. We will revise it if the method becomes known.
Sources
- Primary, SEC 8-KOrion S.A. “Form 8-K, Item 8.01 Other Events”
- Primary, SEC 10-QOrion S.A. “Quarterly Report for the period ended September 30, 2024”
- Primary, SEC 10-KOrion S.A. “Annual Report for the year ended December 31, 2024”
- Primary, SEC 10-KOrion S.A. “Annual Report for the year ended December 31, 2025”
1 more (reporting, analysis)
- PressThe Record “Carbon black supplier Orion loses $60 million in business email compromise scam”
References: “The last layer left in AI-era cyber defense”