TL;DR
- 01What happened
On April 20, 2026, the head of accounting at Hatena, listed on the TSE Growth market, was persuaded by scammers posing as police to install remote-desktop software on a work PC as “cooperation with an investigation.” The scammers used it to send about ¥1.18 billion to outside accounts over two days (company disclosure, special investigation committee report).
- 02Why it went through
At the bank used for payments, the head of accounting’s online-banking login alone could create and approve transfers, with no limit. Internal fund moves refilled it: the director approved the first ¥300 million as “payroll preparation,” and the rest followed without a stated reason, ¥940 million in all.
- 03The missing layer
The bank queried a director on the first evening, but the query was read against the approved fund move. A restriction the bank placed that night was lifted by a call the head of accounting made on the scammers’ instructions, and withdrawals were halted only the next morning. What failed was the layer that checks transfers and fund moves against a documented reason before executing them.
What happened
- Party
- Hatena, which runs blogging and other internet services and a manga viewer for publishers. Listed on the TSE Growth market.
- What happened
- On the morning of April 20, scammers posing as police called the head of accounting’s personal phone, said the head of accounting was a suspect in a money-laundering case, and forbade telling family members. On a video call they showed what they said were police and prosecutor IDs, said the president and the director in charge were also under investigation, and framed every later instruction as “cooperating with the investigation.”
- Remote control
- At 10:39 the head of accounting installed and ran remote-desktop software on the work PC as instructed; from then the scammers operated the PC directly. Its launch was logged internally but not detected. Nothing restricted unapproved applications.
- Transfers
- The scammers created transfers in the payment account and called the head of accounting in to complete the two-factor step at approval, with the explanation that the money was going to a frozen account and would come back. Transfers ran from ¥99.99 million at 11:41 until 10:22 the next day.
- Loss
- ¥1,179.81 million went out; ¥940 million moved between the company’s own accounts. Hatena booked ¥1,221 million in extraordinary losses for FY7/2026, including investigation costs.
- The checker’s question
- At 13:34, the accounting staff member checking fund moves noticed falling balances and an unfamiliar payee and asked about them. The head of accounting replied “I’ll explain later,” and the fund move went ahead. No rule required a documented reason for fund moves.
- Data
- No sign of personal or customer data being taken. The report says it cannot rule out that the scammers saw information on screen during remote control.
Glossary
Remote desktop — Software for operating a PC over the internet from elsewhere. Once installed, the other party can see the screen and control the PC.
Fund move — Moving money between a company's own accounts. Hatena regularly moved funds from its main account to an account used for payroll and other payments.
Special investigation committee — An investigation panel of outside lawyers and others. Hatena's followed the Japan Federation of Bar Associations' guidelines for third-party committees.
Per the special investigation committee’s report, the attack ran as follows.
The stopping points are ③ and ④. Had transfers and fund moves been checked against a documented reason before executing, money would not leave even with the PC under remote control. The bank's query and restriction in ⑤ came early, but the query was read against the approved explanation and the restriction was lifted.
April 20, 8:02, to a personal phone.
10:39. The scammers operate the PC from then on.
One account could create and approve, with no limit.
The director approved the first ¥300M as "payroll preparation." Six more followed without a stated reason: ¥940M in all.
Query on the 20th. The night restriction was lifted by phone. The next morning's transfer failed on the halt.
Timeline — disclosure and response
- 8:02, the scammers call the head of accounting. 10:39, remote desktop installed. 11:41, first fraudulent transfer. 13:13, the director in charge approves a fund move in internal chat. After 16:00, the bank tells the director of three suspicious ¥99.99 million transfers. Fund moves and transfers continue into the night; at 19:52, on the scammers’ instructions, the head of accounting calls the bank and an account restriction is lifted.
- Fund moves and transfers continue after 10:00. 10:53, a transfer fails because the bank has halted withdrawals. 11:08, the head of accounting realizes it is fraud and calls the police.
- Hatena discloses the outflow (up to about ¥1.1 billion).
- Discloses the special investigation committee.
- Books ¥1,179 million as an extraordinary loss and revises its full-year forecast to a net loss.
- Publishes the committee’s report (disclosure version).
- Discloses prevention measures.
The facts rely on Hatena’s disclosures and the special investigation committee’s report (disclosure version; both primary). The report reconstructs events from interviews with the head of accounting and from PC, call and chat records.
After disclosure
- Hatena: Clarified rules for moving funds between its own accounts, requiring multi-step workflow approval and supporting documents in advance. In online banking, request and approval rights will not sit with the same person, approval environments are tightly limited, per-account limits are kept minimal, and automatic notifications are used. Remote-desktop tools are restricted, and training on police-impersonation and similar scams continues. Executives are returning part of their pay.
- Causes cited by the committee: Beyond the head of accounting putting “cooperation” ahead of company rules: an online-banking setting that let one person create and approve transfers (contrary to the company’s accounting rules), no approval limit, no review of account rights, no transaction notifications, no supporting documents needed for fund moves, and accounting reliant on a few individuals. The committee says a setting that kept one person from completing a transfer alone at the payment bank would have prevented the loss.
Why it wasn’t stopped
The failure was not just a matter of spotting a fake call. Both transfers and internal fund moves could be executed on the wording of a request alone, with no layer checking a documented reason.
The first fund move was approved as payroll preparation; the rest followed without a stated reason, still passing through people who created, checked and approved them. A checker noticed something odd and asked, but no rule required a documented reason, and the process moved on.
Proof here means checking, before a transfer or fund move is executed and by a means separate from the requester, that the request has a documented reason that can be matched, and keeping a record. Detection means noticing unusual account activity.
outside accounts
The bank’s query and restriction came early, yet about 23 hours passed before withdrawals stopped. When a checker notices something odd but no rule requires a documented reason, “I’ll explain later” moves the process on, and however many approval steps there are, a disguised request goes through. That distance is the gap between detection and proof, and it is structural.
The same structure appears in the Hong Kong deepfake meeting fraud (a finance employee made 15 transfers on a faked CFO’s instruction).
How to counter this
Execute transfers and internal fund moves only when they match a documented reason. Check by a means separate from the requester, against the supporting record (an invoice, a payroll schedule), not the wording of the request. Then even if staff are deceived or a PC is taken over, money without a documented reason does not move. It sits in front of detection, not in place of it.
Industries and operations to watch
- IndustryMedia and internet services
- Mid-sized listed companies with small accounting teams, where authority concentrates in the accounting lead.
- OperationApproval
- Approval of fund moves between accounts and transfers requested in internal chat.
- OperationAccount administration
- Rights and limits for each online-banking account, and reviewing them.
Do today’s controls close it?
| Control | This case | Why |
|---|---|---|
| Split of create, check, approve | Partial | Fund moves passed through creation, checking and approval. A checker noticed and asked, but no rule required a documented reason. |
| Online-banking two-factor authentication | Partial | The deceived employee completed it. The real person’s action passes authentication. |
| Internal log monitoring | Partial | The remote-desktop launch was logged but not detected. |
| Bank fraud detection | Partial | Queried on day one, restricted that night, halted the next day. The query was read against the approved explanation, and the restriction was lifted. |
- Require a documented reason that can be matched for every transfer and fund move. Match it against a record separate from the request, such as an invoice or a payment schedule.
- Make unmatched transfers and fund moves impossible to execute. Remove settings that let one account create and approve, and set limits.
- Record which request was executed, and what it was checked against. Answer bank inquiries from that record and the account statement. Keep the record as proof.
Three things to confirm about transfers and fund moves
- Can one online-banking account both create and approve a transfer?
- Do internal fund moves between your own accounts require a documented reason?
- When the bank queries activity, is there a step to check the account statement directly?
Note: if the supporting documents themselves are forged, this check can be passed. And it guards the exit for funds; remote control of a work PC still has to be prevented separately, for example by restricting applications.
Sources
- Primary, disclosureHatena “Notice of the occurrence of a fund outflow incident” (in Japanese)
- Primary, disclosureHatena “Notice of establishment of a special investigation committee” (in Japanese)
- Primary, disclosureHatena “Notice of extraordinary loss, deferred tax assets and revised full-year forecast” (in Japanese)
- Primary, disclosure with the special investigation committee’s report, disclosure versionHatena “Notice of publication of the investigation report and partial voluntary return of executive pay” (in Japanese)
- Primary, disclosureHatena “Notice of prevention measures” (in Japanese)
- Primary, disclosureHatena “Notice of differences between forecast and results for FY7/2026, extraordinary loss and reversal of deferred tax assets” (in Japanese)
References: “The last layer left in AI-era cyber defense”