$1.35m penalty for advice network that left 55,000 clients at cyber risk

• The Supreme Court of NSW ordered Fortnum Private Wealth to pay a $1.35 million civil penalty after it admitted failing to adequately manage cybersecurity risks.
• ASIC Chair Sarah Court said the failures exposed authorised representatives and their clients to the risk of cyber-related attacks and cybercrime.
• Justice Black noted the contravening conduct was not deliberate and that Fortnum cooperated with ASIC.

Fortnum Private Wealth Ltd has been ordered by the Supreme Court of New South Wales to pay a $1.35 million penalty after admitting it failed to adequately manage cybersecurity risks across its financial advice network.

During the relevant period, Fortnum’s network comprised between 81 and 94 financial advice practices, more than 200 authorised advisers and around 55,000 retail clients.

Those practices collected and held highly sensitive personal information, including identification documents, tax file numbers and financial account details.

Fortnum admitted that between 20 April 2021 and 11 May 2023 it failed to implement an adequate cybersecurity policy across its business and authorised representative network, failed to implement adequate processes, systems and frameworks to oversee and monitor the cyber resilience of its authorised representatives, failed to maintain adequate human resources with specialised cybersecurity expertise, and failed to maintain adequate cybersecurity risk management systems.

“Today’s outcome is the third obtained by ASIC against a licensee over failures to adequately protect against cybersecurity risk, following previous enforcement actions against RI Advice and FIIG Securities,” ASIC Chair Sarah Court said.

Ms Court said Fortnum was aware of the cybersecurity risks facing its business and authorised representatives but failed to implement an adequate cybersecurity policy and have adequate oversight and monitoring arrangements.

She said the failures “exposed authorised representatives and their clients to the risk of cyber-related attacks and cybercrime and fell below the standard the public is entitled to expect from an AFSL holder.”

Justice Black said he was satisfied the penalty would “provide the necessary sting or burden, given the scale of Fortnum’s business, to achieve the objects of specific deterrence and general deterrence,” adding that it reflected matters agreed between the parties including that the contravening conduct was not deliberate and that Fortnum had cooperated with ASIC during both the investigation and the proceeding.

The Court also ordered Fortnum to pay $250,000 towards ASIC’s costs.

ASIC commenced proceedings against Fortnum in July 2025 after being notified by the company of a cyber attack against one of its authorised representatives.

ASIC’s earlier cyber resilience proceedings were against RI Advice in May 2022 and FIIG Securities in February 2026.

Fortnum has uplifted its cybersecurity framework, including introducing mandatory cyber controls, annual reviews, enhanced training and specialist cyber expertise.