Fortnum Private Wealth Ltd has been ordered by the Supreme Court of NSW to pay a $1.35 million penalty after admitting it failed to adequately manage cybersecurity risks across its financial advice network.
A statement from ASIC says Fortnum also admitted it failed to have adequate cybersecurity expertise and risk management systems “…exposing its authorised representatives and their clients to the risk of cyber-related attacks and cybercrime, that could result in serious harm and loss.”
ASIC says that during the relevant period, Fortnum’s network comprised between 81 and 94 financial advice practices, more than 200 authorised advisers, and around 55,000 retail clients.
“These practices collected and held highly sensitive personal information, including identification documents, tax file numbers and financial account details.”
ASIC Chair Sarah Court says the outcome reinforced that AFSL holders must properly manage and protect against cybersecurity risk.
“ [This] outcome is the third obtained by ASIC against a licensee over failures to adequately protect against cybersecurity risk, following previous enforcement actions against RI Advice and FIIG Securities,” she says.
“In this case, Fortnum was aware of the cybersecurity risks facing its business and authorised representatives but failed to implement an adequate cybersecurity policy and have adequate oversight and monitoring arrangements.
“These failures exposed authorised representatives and their clients to the risk of cyber-related attacks and cybercrime and fell below the standard the public is entitled to expect from an AFSL holder.”
Court says this outcome reinforces ASIC’s continued focus on licensees getting the fundamentals right.
We will continue to work with industry to lift standards and take action where businesses fall short…
“Strong cyber resilience is critical to maintaining trust and confidence in our financial system. We will continue to work with industry to lift standards and take action where businesses fall short,” she said.
Fortnum admitted that, between 20 April 2021 and 11 May 2023, it:
- Failed to implement an adequate cybersecurity policy to manage and mitigate cybersecurity risks across its business and authorised representative network
- Failed to implement adequate processes, systems and frameworks to oversee and monitor the cyber resilience of its authorised representatives
- Failed to maintain adequate human resources with specialised cybersecurity expertise
- Failed to maintain adequate cybersecurity risk management systems
ASIC says Justice Black noted that the parties had agreed that as a result of its failures Fortnum exposed its authorised representatives and their retail clients to “..the risk of cyber-related attacks and cybercrime, the consequences of which could include serious harm and loss.”
His Honour Justice Black also stated: “I am satisfied that the proposed pecuniary penalty in the total amount of $1.35 million will provide the necessary sting or burden, given the scale of Fortnum’s business, to achieve the objects of specific deterrence and general deterrence. That penalty properly reflects the matters agreed between the parties, including the fact that the contravening conduct was not deliberate and that Fortnum has cooperated with ASIC, both during the investigation stage and in the conduct of this proceeding.”
The Court also ordered Fortnum to pay $250,000 towards ASIC’s costs.
As background ASIC says it commenced proceedings against Fortnum in July 2025 after it was notified by Fortnum of a cyber attack against one of its authorised representatives.
“Fortnum has uplifted its cybersecurity framework, including introducing mandatory cyber controls, annual reviews, enhanced training and specialist cyber expertise,” the regulator says.
A Governance Responsibility
Riskinfo asked cybersecurity expert Fraser Jack of The Cyber Collective for his comment on the case and he noted the Fortnum case is a reminder that cybersecurity is not simply a technology issue; it’s a governance responsibility.
“The key lessons are about setting minimum standards, making participation mandatory, and ensuring directors have the oversight, capability and reporting needed to understand and manage cyber risks,” he says.
“The case also highlights the risks associated with related entities, third-party providers and legacy client data. Just because information is no longer being actively used doesn’t mean the responsibility to protect it disappears.
Directors need to consider whether the decisions they’re making today will stand up to regulatory scrutiny in the future…
“What’s particularly interesting is that Fortnum is being judged today on decisions and actions taken three to five years ago. Directors need to consider whether the decisions they’re making today will stand up to regulatory scrutiny in the future.
“Ultimately, having cybersecurity policies isn’t enough. Directors need visibility over what’s actually happening across their businesses and evidence that the right things are being done.
Jack says this could happen to any licensee “…and I don’t believe this will be the last case we see.”
