The Australian Securities and Investments Commission (ASIC) has secured a Supreme Court of New South Wales order requiring Fortnum Private Wealth Ltd to pay an AUD 1.35 million penalty for failing to adequately manage cybersecurity risks across its financial advice network. Fortnum admitted that its deficient policies, oversight, specialist resources and risk management systems exposed authorized representatives and retail clients to cyberattacks and cybercrime. The court also ordered Fortnum to pay AUD 250,000 toward ASIC’s costs. Between April 20, 2021, and May 11, 2023, Fortnum’s network comprised 81 to 94 financial advice practices, more than 200 authorized advisers and about 55,000 retail clients. The practices held sensitive information including identification documents, tax file numbers and financial account details. ASIC began proceedings in July 2025 after Fortnum reported a cyberattack against an authorized representative. Fortnum has since introduced mandatory cyber controls, annual reviews, enhanced training and specialist cybersecurity expertise. The case is ASIC’s third successful enforcement outcome against a licensee over inadequate cybersecurity protections, following proceedings against RI Advice and FIIG Securities. The court found the penalty appropriate for deterrence, while recognizing that Fortnum’s conduct was not deliberate and that it cooperated with ASIC.
Australian Securities and Investments Commission secures AUD 1.35 million penalty against Fortnum for cybersecurity risk failures
ASIC has secured an AUD 1.35 million penalty against Fortnum Private Wealth for inadequate cybersecurity controls across a network serving about 55,000 retail clients. Fortnum admitted deficiencies in its policies, oversight, specialist resources and risk management systems, and must also pay AUD 250,000 toward ASIC’s costs. The case is ASIC’s third enforcement outcome against a licensee over cybersecurity failures.