Financial services licensees are answerable for the cyber resilience of their authorised representatives, not just their own systems. Fortnum Private Wealth has been ordered to pay a $A1.35 million penalty for failing to manage cyber risk across its advice network.
Justice Black of the Supreme Court of NSW made the orders in Australian Securities and Investments Commission v Fortnum Private Wealth Ltd. Fortnum must also pay $A250,000 towards ASIC's costs.
Fortnum admitted to failures between 20 April 2021 and 11 May 2023. It did not implement an adequate cybersecurity policy to manage cyber risk across its business and representative network.
It also admitted failing to adequately oversee and monitor the cyber resilience of its authorised representatives. It failed to maintain enough staff with specialised cybersecurity expertise, and failed to maintain adequate cybersecurity risk management systems.
During that period Fortnum's network comprised between 81 and 94 advice practices, more than 200 authorised advisers and around 55,000 retail clients. The practices held identification documents, tax file numbers and financial account details.
Justice Black noted the parties had agreed Fortnum exposed its representatives and their retail clients to "...the risk of cyber-related attacks and cybercrime, the consequences of which could include serious harm and loss."
He said the penalty would "provide the necessary sting or burden, given the scale of Fortnum's business, to achieve the objects of specific deterrence and general deterrence". He noted the conduct was not deliberate and that Fortnum had cooperated with ASIC.
ASIC Chair Sarah Court said Fortnum "was aware of the cybersecurity risks facing its business and authorised representatives but failed to implement an adequate cybersecurity policy and have adequate oversight and monitoring arrangements".
"This outcome reinforces ASIC's continued focus on licensees getting the fundamentals right. Strong cyber resilience is critical to maintaining trust and confidence in our financial system," she said.
Third cyber outcome
It is the third outcome ASIC has obtained against a licensee over cyber risk failures. It follows RI Advice in 2022 and FIIG Securities in February.
The Federal Court ordered FIIG to pay $2.5 million in penalties plus $500,000 in costs over failures between March 2019 and June 2023, IDM reported. A 2023 attack on FIIG affected about 18,000 clients.
ASIC began proceedings against Fortnum in July 2025, after Fortnum notified it of a cyber attack on one of its authorised representatives. When the case was filed, ASIC alleged the personal data of more than 9,000 clients had been published on the dark web.
According to ASIC, Fortnum has since introduced mandatory cyber controls, annual reviews, enhanced training and specialist cyber expertise.