Fortnum Private Wealth Ltd has been ordered by the Supreme Court of NSW to pay a $1.35 million penalty after admitting it failed to adequately manage cybersecurity risks across its financial advice network.
Fortnum also admitted it failed to have adequate cybersecurity expertise and risk management systems, exposing its authorised representatives and their clients to the risk of cyber-related attacks and cybercrime, that could result in serious harm and loss.
During the relevant period, Fortnum's network comprised between 81 and 94 financial advice practices, more than 200 authorised advisers, and around 55,000 retail clients. These practices collected and held highly sensitive personal information, including identification documents, tax file numbers and financial account details.
ASIC Chair Sarah Court said the outcome reinforced that AFSL holders must properly manage and protect against cybersecurity risk.
‘Today’s outcome is the third obtained by ASIC against a licensee over failures to adequately protect against cybersecurity risk, following previous enforcement actions against RI Advice and FIIG Securities.
‘In this case, Fortnum was aware of the cybersecurity risks facing its business and authorised representatives but failed to implement an adequate cybersecurity policy and have adequate oversight and monitoring arrangements.
‘These failures exposed authorised representatives and their clients to the risk of cyber-related attacks and cybercrime and fell below the standard the public is entitled to expect from an AFSL holder.
‘This outcome reinforces ASIC’s continued focus on licensees getting the fundamentals right. Strong cyber resilience is critical to maintaining trust and confidence in our financial system. We will continue to work with industry to lift standards and take action where businesses fall short,' the Chair said.
Fortnum admitted that, between 20 April 2021 and 11 May 2023, it:
- failed to implement an adequate cybersecurity policy to manage and mitigate cybersecurity risks across its business and authorised representative network
- failed to implement adequate processes, systems and frameworks to oversee and monitor the cyber resilience of its authorised representatives
- failed to maintain adequate human resources with specialised cybersecurity expertise, and
- failed to maintain adequate cybersecurity risk management systems.
Justice Black noted that the parties had agreed that as a result of its failures Fortnum exposed its authorised representatives and their retail clients to ‘...the risk of cyber-related attacks and cybercrime, the consequences of which could include serious harm and loss.’
His Honour Justice Black also stated, 'I am satisfied that the proposed pecuniary penalty in the total amount of $1.35 million will provide the necessary sting or burden, given the scale of Fortnum's business, to achieve the objects of specific deterrence and general deterrence. That penalty properly reflects the matters agreed between the parties, including the fact that the contravening conduct was not deliberate and that Fortnum has cooperated with ASIC, both during the investigation stage and in the conduct of this proceeding.'
The Court also ordered Fortnum to pay $250,000 towards ASIC's costs.
Previous proceedings filed by ASIC alleging cyber resilience failures include those against RI Advice in May 2022 (22-104MR) and FIIG Securities in February 2026 (26-021MR).
Downloads
Background
ASIC commenced proceedings against Fortnum in July 2025 after it was notified by Fortnum of a cyber attack against one of its authorised representatives (25-143MR).
Fortnum has uplifted its cybersecurity framework, including introducing mandatory cyber controls, annual reviews, enhanced training and specialist cyber expertise.