Fortnum Private Wealth fined $1.35 million over cyber failures across its adviser network

Financial advice licensee Fortnum Private Wealth has been ordered to pay a $1.35 million penalty for failing to adequately manage cybersecurity risk across its network of advice practices. The Supreme Court of NSW made the order on 12 October 2026, and ASIC announced it on 14 October. Fortnum must also pay $250,000 towards ASIC’s costs.

The case matters beyond one company. It is the third time ASIC has won a court outcome against an Australian financial services (AFS) licensee over cybersecurity, and it shows the regulator treats cyber controls as part of a licensee’s basic obligations, including for the practices that operate under its licence.

What Fortnum admitted

According to ASIC’s announcement, Fortnum admitted that between 20 April 2021 and 11 May 2023 it:

• failed to implement an adequate cybersecurity policy to manage and mitigate cybersecurity risks across its business and authorised representative network
• failed to implement adequate processes, systems and frameworks to oversee and monitor the cyber resilience of its authorised representatives
• failed to have enough staff with specialised cybersecurity expertise
• failed to maintain adequate cybersecurity risk management systems.

The judgment records these as admitted breaches of sections 912A(1)(a), (d) and (h) of the Corporations Act. Those are the general licensee obligations to provide services efficiently, honestly and fairly, to have adequate resources, and to have adequate risk management systems.

During that period, ASIC says, Fortnum’s network comprised between 81 and 94 advice practices, more than 200 authorised advisers and around 55,000 retail clients. The practices held highly sensitive information, including identification documents, tax file numbers and financial account details.

How the case started

ASIC sued Fortnum in July 2025 after Fortnum told it about a cyber attack on one of its authorised representatives. The judgment records that Fortnum became aware of a data breach at that practice around 18 November 2022, and that a significant amount of data was released on the dark web around 2 March 2023. Fortnum reported the incident to ASIC on 30 March 2023, the same day the practice lodged a report with the Office of the Australian Information Commissioner.

The judgment also shows Fortnum wasn’t doing nothing. Its April 2021 policy required practices to take certain steps and complete a self-assessment by 1 September 2021, and Fortnum said it would turn on multi-factor authentication centrally for its main client records system and for DocuSign from 1 April 2021. It also offered an optional “Advanced Strategy” modelled on Maturity Level 1 of the Essential Eight. Fortnum admitted, and the court accepted, that this fell short: during the period Fortnum had between 22 and 32 employees, none with specialised cybersecurity qualifications, experience or expertise, and it didn’t formally engage a cybersecurity specialist to help develop the policy.

Why the penalty was $1.35 million

The parties agreed the penalty. The judgment notes that the three contraventions carried a maximum available penalty of $33.3 million. Justice Black said $1.35 million would provide “the necessary sting or burden” given the scale of Fortnum’s business, and that it reflected agreed matters including that the conduct was not deliberate and that Fortnum cooperated with ASIC.

ASIC says Fortnum has since uplifted its cybersecurity framework, including mandatory cyber controls, annual reviews, enhanced training and specialist cyber expertise.

The pattern in ASIC’s cases

ASIC Chair Sarah Court said the outcome was the third against a licensee over cybersecurity, after RI Advice and FIIG Securities. In February, the Federal Court ordered FIIG Securities to pay $2.5 million. ASIC said at the time that FIIG’s failures included not having multi-factor authentication for remote access users, a structured plan for updating key software, qualified IT staff monitoring threat alerts, mandatory cyber awareness training, and a cyber incident response plan tested at least annually.

“This outcome reinforces ASIC’s continued focus on licensees getting the fundamentals right,” Ms Court said.

On our reading, the Fortnum case adds one point for licensees with authorised representatives: having a policy isn’t enough on its own. The admitted failures included not adequately overseeing or monitoring how practices in the network actually managed cyber risk. If you run a practice under someone else’s licence, expect your licensee to ask more questions about your security, and to check the answers. ASD’s new Essentials framework is one starting point for that conversation.

Checklist

• Ask your licensee for its cyber requirements. If you run a practice as an authorised representative, get the current minimum controls in writing and confirm you meet each one.
• Turn on multi-factor authentication. Cover remote access and every system that holds client identity documents, tax file numbers or bank details.
• Make cyber training mandatory. Require cybersecurity training for every adviser and staff member, and record who has completed it.
• Write and test an incident response plan. Test it at least once a year, the standard ASIC pointed to in the FIIG Securities case.
• Get specialist cyber expertise. Employ or formally engage a person with specialised cybersecurity experience to help set and oversee your controls.
• Plan your software updates. Keep a schedule for patching the key systems your practice relies on, so security fixes aren’t missed.
• Monitor your network if you are a licensee. Check how each authorised representative actually manages cyber risk, not just whether it has completed a self-assessment.