Orion S.A. Suffers $60 Million Loss in Suspected BEC Attack

A major chemical conglomerate from Luxembourg, Orion S.A., has suffered a loss of $60 million due to a fraudulent bank transfer scheme.

In a statement to the U.S. Securities and Exchange Commission (SEC), Orion S.A. detailed the incident, which bears a strong resemblance to a Business Email Compromise (BEC) scheme. Although the term was not explicitly mentioned, the nature of the event strongly suggests this type of fraud.

According to Orion S.A., the incident occurred on August 10, when one of the company’s employees fell victim to a fraudulent scheme, resulting in several unauthorized transfers of funds to accounts held by unknown third parties. It is important to note that the company’s systems were not breached, and no data was compromised.

Orion S.A. has already notified law enforcement authorities and intends to utilize all available resources, including insurance claims, to recover the stolen funds. The investigation into the incident is ongoing, and the company continues to assess the impact of the event on its internal processes and security.

BEC attacks are often associated with the forgery of trusted email addresses, such as those of suppliers with whom the victim company’s accounting department regularly conducts large financial transactions. The fraudsters meticulously study the victim and its partners to make the deception as convincing as possible.