![\"Sarah](\"https:\/\/riskinfo.com.au\/news\/files\/2021\/08\/Sarah-Court-e1627963164564.jpg\")
<\/a>ASIC says that during the relevant period, Fortnum’s network comprised between 81 and 94 financial advice practices, more than 200 authorised advisers, and around 55,000 retail clients.<\/p>\n
\u201cThese practices collected and held highly sensitive personal information, including identification documents, tax file numbers and financial account details.\u201d<\/p>\n
ASIC Chair Sarah Court<\/strong> says the outcome reinforced that AFSL holders must properly manage and protect against cybersecurity risk.<\/p>\n \u201c [This] outcome is the third obtained by ASIC against a licensee over failures to adequately protect against cybersecurity risk, following previous enforcement actions against RI Advice and FIIG Securities,\u201d she says.<\/p>\n \u201cIn this case, Fortnum was aware of the cybersecurity risks facing its business and authorised representatives but failed to implement an adequate cybersecurity policy and have adequate oversight and monitoring arrangements.<\/p>\n \u201cThese failures exposed authorised representatives and their clients to the risk of cyber-related attacks and cybercrime and fell below the standard the public is entitled to expect from an AFSL holder.\u201d<\/p>\n Court says this outcome reinforces ASIC\u2019s continued focus on licensees getting the fundamentals right.<\/p>\n We will continue to work with industry to lift standards and take action where businesses fall short…<\/p><\/blockquote>\n \u201cStrong cyber resilience is critical to maintaining trust and confidence in our financial system. We will continue to work with industry to lift standards and take action where businesses fall short,” she said.<\/p>\n Fortnum admitted that, between 20 April 2021 and 11 May 2023, it:<\/p>\n ASIC says Justice Black<\/strong> noted that the parties had agreed that as a result of its failures Fortnum exposed its authorised representatives and their retail clients to \u201c..the risk of cyber-related attacks and cybercrime, the consequences of which could include serious harm and loss.\u201d<\/p>\n His Honour Justice Black also stated: \u201cI am satisfied that the proposed pecuniary penalty in the total amount of $1.35 million will provide the necessary sting or burden, given the scale of Fortnum’s business, to achieve the objects of specific deterrence and general deterrence. That penalty properly reflects the matters agreed between the parties, including the fact that the contravening conduct was not deliberate and that Fortnum has cooperated with ASIC, both during the investigation stage and in the conduct of this proceeding.\u201d<\/p>\n The Court also ordered Fortnum to pay $250,000 towards ASIC’s costs.<\/p>\n As background ASIC says it commenced proceedings against Fortnum in July 2025 after it was notified by Fortnum of a cyber attack against one of its authorised representatives.<\/p>\n \u201cFortnum has uplifted its cybersecurity framework, including introducing mandatory cyber controls, annual reviews, enhanced training and specialist cyber expertise,\u201d the regulator says.<\/p>\n A Governance Responsibility<\/strong><\/p>\n\n
<\/a>