Fortnum Private Wealth Fined Over Cybersecurity Failures Affecting 55,000-Client Network

Key Takeaways

• $939,000 Cybersecurity Penalty: The Supreme Court of New South Wales ordered Fortnum Private Wealth to pay approximately $939,000 (A$1.35 million) for failing to adequately manage cybersecurity risks across its financial advice network.
• 55,000 Clients Exposed to Risk: The failures affected a network comprising between 81 and 94 financial advice practices and more than 200 authorized advisers handling sensitive personal and financial information.
• Inadequate Cybersecurity Oversight: Fortnum admitted deficiencies in its cybersecurity policies, monitoring arrangements, specialist expertise and risk management systems between April 2021 and May 2023.
• Court Recognizes Cooperation: Justice Black acknowledged that Fortnum's conduct was not deliberate and that the company cooperated with ASIC, but found a substantial penalty necessary to deter similar failures.
• Third ASIC Enforcement Outcome: The ruling follows previous cybersecurity enforcement actions against RI Advice and FIIG Securities, reflecting ASIC's continued scrutiny of financial services licensees.

Deep Dive

Australian financial services firm Fortnum Private Wealth has been ordered to pay a $939,000 (A$1.35 million) penalty after admitting it failed to adequately manage cybersecurity risks across a network of financial advisers serving around 55,000 retail clients.

The Supreme Court of New South Wales imposed the penalty following proceedings brought by the Australian Securities and Investments Commission (ASIC), which announced the outcome on October 14.

Between April 2021 and May 2023, Fortnum's network comprised between 81 and 94 financial advice practices and more than 200 authorized advisers. Those practices collected and stored sensitive client information, including identification documents, tax file numbers and financial account details.

Fortnum admitted that its cybersecurity policies, supervisory arrangements and risk management systems were inadequate during that period. It also acknowledged that it had failed to maintain sufficient personnel with specialized cybersecurity expertise.

ASIC Chair Sarah Court said the company had been aware of the cybersecurity risks confronting its business and authorized representatives but had failed to establish adequate protections.

"These failures exposed authorised representatives and their clients to the risk of cyber-related attacks and cybercrime and fell below the standard the public is entitled to expect from an AFSL holder," Court said.

The court also ordered Fortnum to pay approximately $174,000 (A$250,000) toward ASIC's legal costs.

Inadequate Oversight of Financial Advisers

Fortnum's admitted failures extended across its financial advice network, where individual practices handled sensitive information belonging to thousands of clients. The company had not implemented an adequate cybersecurity policy to manage and mitigate risks throughout its business and authorized representative network. It also lacked sufficient processes and systems to oversee and monitor the cyber resilience of those representatives.

The deficiencies persisted from April 20, 2021, until May 11, 2023. Its network included dozens of separate advice practices, but the company remained responsible for maintaining adequate arrangements to oversee cybersecurity risks affecting its authorized representatives.

The proceedings established failures in those arrangements and the resulting exposure to potential harm. The penalty was imposed for Fortnum's admitted contraventions, rather than for a specified amount of financial loss suffered by clients.

Justice Black, who approved the penalty, acknowledged that Fortnum's conduct had not been deliberate and that the company had cooperated with ASIC throughout the investigation and court proceedings.

Nevertheless, the judge found that a substantial penalty was warranted given the size of the business and the need to deter similar failures.

"I am satisfied that the proposed pecuniary penalty in the total amount of $1.35 million will provide the necessary sting or burden, given the scale of Fortnum's business, to achieve the objects of specific deterrence and general deterrence," Justice Black said.

The judge concluded that the penalty appropriately reflected the circumstances agreed between ASIC and Fortnum, including the company's cooperation and the absence of deliberate misconduct.

Third ASIC Cybersecurity Enforcement Outcome

The ruling marks ASIC's third court outcome against a financial services licensee over failures to adequately manage cybersecurity risks. In May 2022, the Federal Court found that RI Advice had failed to maintain adequate cybersecurity risk management systems. More recently, in February 2026, FIIG Securities was ordered to pay approximately $1.74 million (A$2.5 million) following ASIC proceedings concerning cybersecurity failures.

The Fortnum case follows those actions, with the regulator continuing to examine whether financial services businesses have adequate policies, expertise and oversight arrangements to manage cybersecurity risks. Court said the outcome reinforced ASIC's expectations of licensees, particularly where failures could expose clients to serious harm.

"Strong cyber resilience is critical to maintaining trust and confidence in our financial system. We will continue to work with industry to lift standards and take action where businesses fall short," she said.

Fortnum's admissions covered nearly two years of inadequate cybersecurity risk management across a network responsible for sensitive financial and personal information. Although the court recognized that the failures were not deliberate, it accepted the $939,000 (A$1.35 million) penalty as necessary to deter further breaches of financial services licensing obligations.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey