In this week's C&EN, this unfortunate news (article by Alexander H. Tullo):
The carbon black maker Orion has been scammed out of $60 million in a wire transfer fraud scheme.
The company rooted out the fraud earlier this month, it disclosed in a filing with the US Securities and Exchange Commission. An employee, the filing says, “was the target of a criminal scheme that resulted in multiple fraudulently induced outbound wire transfers to accounts controlled by unknown third parties.”
Orion adds that it will record a pretax charge of $60 million if it can’t recover more of its misappropriated funds. Such a loss would be significant for Orion. In 2023, the company earned just over $100 million in profits on $1.9 billion in sales.
The company is cooperating with law enforcement and declines to comment further about the breach because of the ongoing investigation. But the scam bears the hallmarks of a business email compromise (BEC) attack, according to Selena Larson, a threat researcher at the cybersecurity consulting firm Proofpoint.
I find this kind of thing pretty alarming, in that it seems it could happen at any company, no matter how large.
