Breach taxonomy
Summary
On August 10, 2024, Orion S.A. disclosed that a company employee was the target of a criminal scheme resulting in multiple fraudulently induced outbound wire transfers to accounts controlled by unknown third parties. The company expects to record a one-time pre-tax charge of approximately $60 million for the unrecovered fraudulent transfers. No unauthorized access to company data or systems was identified. Law enforcement is cooperating and the company intends to pursue recovery through all available legal means including potentially available insurance coverage.
Tagging rationale
ThreatCyber Criminals
Filing explicitly describes a criminal scheme targeting the company via fraudulent wire transfer inducement → CYBER-CRIMINALS.
MethodsPhishing
An employee was fraudulently induced to authorize multiple wire transfers, a hallmark of business email compromise / phishing-based financial fraud → PHISHING.
AssetsCash Equivalent
The criminal scheme resulted in approximately $60 million in fraudulent wire transfers to accounts controlled by third parties → CASH-EQUIVALENT.
EffectsFinancial Fraud
Approximately $60 million was misdirected through fraudulent wire transfers → FINANCIAL-FRAUD.
Impact
Approximately $60 million in confirmed financial loss from wire fraud; no data breach or operational disruption; single incident affecting a materials company → score 3.
InsuranceYes
Filing states the company intends to pursue recovery including potentially available insurance coverage → true.
Read the original SEC filing excerpt
Item 8.01 Other Events. On August 10, 2024, Orion S.A. (the Company) determined that a Company employee, who is not a Named Executive Officer, was the target of a criminal scheme that resulted in multiple fraudulently induced outbound wire transfers to accounts controlled by unknown third parties. As a result of this incident, and if no further recoveries of transferred funds occur, the Company expects to record a one-time pre-tax charge of approximately $60 million for the unrecovered fraudulent wire transfers. The Company has cooperated, and will continue to cooperate, with law enforcement as appropriate, and intends to pursue recovery of these funds through all legally available means, including potentially available insurance coverage. To date, the Company has not found any evidence of additional fraudulent activity and currently does not believe the incident resulted in any unauthorized access to data or systems maintained by the Company. However, the Company's investigation into the incident and its impacts on the Company, including its internal controls, remains ongoing. The business and operations were not affected.