The Supreme Court of New South Wales has ordered Fortnum Private Wealth to pay a AU$1.35m (£713,000) penalty for failing to adequately manage cybersecurity risks across its financial advice network.
Fortnum admitted the negligence, which could have resulted in huge losses for its authorised representatives and their clients.
Between April 2021 and May 2023 there were between 81 and 94 financial advice practices in Fortnum’s network, with more than 200 authorised advisers, and around 55,000 retail clients, which held highly sensitive personal information such as identification documents, tax file numbers and financial account details.
ASIC began proceedings against Fortnum in July 2025 after it was notified by Fortnum of a cyber attack against one of its authorised representatives. Fortnum was also ordered to pay AU$250,000 (£132,000) towards ASIC’s costs.
His Honour Justice Black said: “I am satisfied the proposed pecuniary penalty in the total amount of $1.35m will provide the necessary sting or burden, given the scale of Fortnum’s business, to achieve the objects of specific deterrence and general deterrence.
“That penalty properly reflects the matters agreed between the parties, including the fact that the contravening conduct was not deliberate and that Fortnum has cooperated with ASIC, both during the investigation stage and in the conduct of this proceeding.”
ASIC chair Sarah Court said the outcome reinforced that AFSL holders must properly manage and protect against cybersecurity risk.
“Today’s outcome is the third obtained by ASIC against a licensee over failures to adequately protect against cybersecurity risk, following previous enforcement actions against RI Advice and FIIG Securities,” she said.
“This outcome reinforces ASIC’s continued focus on licensees getting the fundamentals right. Strong cyber resilience is critical to maintaining trust and confidence in our financial system. We will continue to work with industry to lift standards and take action where businesses fall short.”
