Orion S.A. recorded a $59.3 million pre-tax charge in 2024 after an employee was tricked into wiring funds to criminals, a loss equal to nearly 58% of that year's operating income.
The carbon black producer disclosed the incident in its 2025 annual report, noting the scheme involved email manipulation rather than a system hack. The company recovered $9.2 million in 2025 but continues to pursue insurance coverage for the remaining balance.
Impact on financial statements
The fraud significantly altered Orion's reported earnings for 2024. The charge comprised $55.7 million in unrecovered transfers and $3.6 million in investigation fees. This expense reduced income from operations to $102.7 million, down from $205.3 million in 2023.
Notably, Orion excludes this loss from its adjusted EBITDA calculation as a non-recurring item. Consequently, the company's adjusted EBITDA of $302.2 million for 2024 does not reflect the direct impact of the fraud, a treatment common among listed companies but one that obscures the full cost from certain screening metrics.
| Metric |
FY2024 Value |
Context |
| Fraud Charge |
$59.3 million |
Pre-tax, includes investigation fees |
| Operating Income |
$102.7 million |
Down from $205.3 million in 2023 |
| Adjusted EBITDA |
$302.2 million |
Excludes the fraud charge |
| Recovery (2025) |
$9.2 million |
Partial clawback of funds |
What the numbers show
The divergence between Orion's GAAP operating income and its adjusted EBITDA highlights a critical disclosure gap for investors. While the $59.3 million charge reduced GAAP operating income by nearly 60% year-on-year, it is entirely absent from the adjusted EBITDA figure of $302.2 million. This means analysts relying solely on adjusted metrics may underestimate the operational drag caused by internal control failures. Furthermore, the recovery rate remains low; only $9.2 million of the $59.3 million charge has been recovered so far, leaving significant exposure on the balance sheet.
Broader risk landscape
Orion's experience reflects a wider trend in corporate fraud. Business email compromise generated $3.05 billion in reported losses across 24,768 complaints in 2025, up from $2.77 billion in 2024, according to the FBI's Internet Crime Report. The attack surface has expanded beyond email to include phone numbers and virtual meeting applications, with AI-related complaints logging losses above $893 million.
Deepfake technology exacerbates this risk. A Gartner survey found that 62% of organizations experienced a deepfake attack in the prior 12 months. In a notable case, a finance worker at engineering firm Arup transferred $25.6 million after joining a video call featuring deepfaked executives.
Insurance limitations
Shareholders often assume such losses are fully insured, but coverage gaps are frequent. Many standard cyber policies exclude social engineering losses or cap them at sublimits of $250,000 or less. Against the Arup example, roughly 99% of a $25.6 million loss would fall outside a typical $250,000 sublimit, leaving the majority of the loss self-insured.
- Non-GAAP Add-backs: Fraud losses often appear in adjusted EBITDA reconciliations as non-recurring items.
- Item 8.01 Filings: Impersonation losses may be reported as "other events" rather than cybersecurity incidents under Item 1.05.
- Recovery Language: Phrases like "potentially available" insurance indicate unbooked assets.
Mitigation strategies
Few organizations effectively deploy AI to counter these threats. Only 17% of firms use AI to combat payments fraud, though 45% of those users report better deepfake detection. Procedural controls remain vital. Experts recommend phishing-resistant multi-factor authentication for payment approvals and callback verification to known numbers. The FBI's Recovery Asset Team froze $679 million of $1.16 billion in attempted theft in 2025, demonstrating that rapid response can mitigate losses, but prevention through strict verification protocols remains the primary defense.
Access 50+ Readymade Screeners 
Use 200+ Custom Filters 
Get Full Market Insights 
