Orion's $59.3 million fraud charge spotlights wire scams

Orion S.A. recorded a $59.3 million 2024 fraud charge after an Aug. 10, 2024 wire-transfer scam, a Benzinga opinion article said, citing the company’s annual report and SEC filing.

The figure equaled about 58% of Orion’s $102.7 million 2024 operating income, which fell from $205.3 million in 2023, according to the annual report figures.

What it means

The case gives investors a measured example of how a social-engineering fraud can become an earnings event. Orion, a carbon black producer run from Spring, Texas, said no data or systems were accessed.

That distinction matters because the reported loss did not begin with a network intrusion. It began with an employee being persuaded to transfer money to accounts controlled by unidentified third parties, according to the filing.

Akif Khan, a senior director at Gartner Research, told Infosecurity Magazine: "You can’t just rely on automated defenses to protect you." His proposed control is to require the executive requesting a transfer to approve it inside the finance system, ideally with phishing-resistant multi-factor authentication.

The Benzinga article frames the Orion case as a disclosure and earnings question, not only a cybersecurity question. If a transfer is induced by deception rather than a systems breach, the loss can still reduce operating income and require investors to study filings outside the usual cyber-risk categories.

The Orion charge

Orion’s annual report broke the $59.3 million charge into $55.7 million of unrecovered transfers and $3.6 million of investigation costs. The company also recovered $9.2 million in 2025 and incurred another $2.3 million of professional fees.

Orion excluded the item from adjusted EBITDA, a non-GAAP measure that shows earnings before interest, taxes, depreciation and amortization. Its 2024 adjusted EBITDA was $302.2 million after excluding the fraud loss as non-recurring.

That accounting treatment does not erase the cash impact. It does mean a large fraud charge can sit outside a profit measure widely used by analysts and investors to compare company performance.

The disclosure route was also significant. Orion reported the matter under Item 8.01 of Form 8-K, the general “other events” category, rather than as a cybersecurity incident under Item 1.05, after saying no data or systems were accessed.

The stock context adds scale, though not causation. Orion traded at $5.93 on Sept. 21, giving it a market value of about $335 million, and the company also absorbed an $80.8 million goodwill impairment in 2025.

The Benzinga article said the 2024 charge alone equaled nearly 18% of that market value. It also said the fraud was not the only pressure on Orion’s shares, separating the transfer loss from other company-specific financial effects.

Deepfake risk expands

Business email compromise produced $3.05 billion of reported U.S. victim losses across 24,768 complaints in 2025, up from $2.77 billion in 2024, according to the FBI Internet Crime Report. The FBI definition cited in the article includes compromised phone numbers and virtual meeting applications.

The same FBI report counted 22,364 complaints referencing artificial intelligence, with losses above $893 million. Those figures do not prove that deepfakes caused all AI-linked losses, but they show why finance chiefs are treating impersonation as more than an email-control problem.

The article cited a 2024 case at Arup, the private engineering firm, in which a Hong Kong finance employee made 15 transfers totaling $25.6 million after joining a video call where the apparent finance chief and colleagues were deepfakes. Because Arup is private, the case did not create the same public-company reporting questions.

Survey data point to broader exposure. A Gartner survey found that 62% of organizations had experienced a deepfake attack in the prior 12 months, and an Association for Financial Professionals survey found that 74% of organizations were affected by business email compromise in 2025.

The article also cited Gartner data showing that 32% of organizations had faced an attack on AI applications through the application prompt. That points to a separate risk for companies adding AI tools to workflows: the tools themselves can become targets if controls are weak.

The business risk is partly operational. Finance teams often need to move funds quickly, and senior executives leave public records of their voices through earnings calls and presentations, creating material that criminals may try to imitate.

Insurance and controls

Insurance may not absorb much of a large impersonation loss. Hunton said many standard cyber policies exclude social-engineering and fraudulent-transfer losses, and that available coverage can be capped at $250,000 or less.

A sublimit is a smaller cap inside a broader insurance policy. Against the Arup example, a $250,000 sublimit would cover less than 1% of a $25.6 million transfer loss.

Some policies also require employees to verify bank-account changes through a separate channel, and failure to meet that condition may put coverage at risk, according to Hunton. In that structure, the payment approval process is not only an internal control; it can affect insurance recovery.

The article showed that low-cost human checks can block sophisticated attempts. MIT Sloan Management Review recounted a July 2024 incident at Ferrari in which an executive received WhatsApp messages and a call using a cloned version of CEO Benedetto Vigna’s voice; the caller ended the conversation after being asked to name a book Vigna had recommended.

Companies are also using technology against the problem, but adoption is limited. The AFP survey found that 17% of organizations used AI to fight payments fraud, while 45% of those users reported improved deepfake detection.

The control lesson is narrower than a general call for more security spending. The Benzinga article cited procedures such as pre-agreed code phrases, a rule that payment approval cannot happen only on a call, and callbacks to numbers already on file.

The recovery process can help, but only after the money has moved. The FBI Recovery Asset Team froze $679 million of $1.16 billion in attempted theft across 3,900 incidents in 2025, a 58% success rate, according to the FBI report.

For investors, the filing trail is concrete: adjusted-earnings reconciliations, Item 8.01 disclosures, insurance-recovery wording and management descriptions of payment approvals. Orion’s annual report used the phrase "potentially available insurance coverage" for ongoing recovery efforts.

The unanswered questions in Orion’s case are practical ones: how much more, if anything, can be recovered; whether insurance will cover part of the loss; and whether payment controls have changed. The supplied material does not include company comment beyond the cited filings.

Source: opinion article, Benzinga, Oct. 12, 2026