1a12d6ac04ac2ea4d89d2fa3

www.caselaw.nsw.gov.au • October 15, 2026

CORPORATIONS — d eficiencies in financial adviser’s policies for and implementation of defences against cyber-related attacks — where steps have been taken to address deficiencies — where Defendant admitted contraventions of ss 912A(1)(a), 912A(1)(d), 912A(1)(h) of the Corporations Act 2001 ( Cth) — w here parties prepared a statement of agreed facts and jointly proposed declarations of contravention and a pecuniary penalty— w hether declaratory relief should be granted — whether proposed pecuniary penalty is an appropriate penalty

- Australian Securities and Investments Commission Act 2001 ( Cth), s 91

- Corporations Act 2001 (Cth ) ss 761G, 766B, 912A(1) (a), (d), (h), 912A (5A), 916A, 1317E

- Ainsworth v Criminal Justice Commission (1992) 175 CLR 564; [1992] HCA 10

- Australian Building and Construction Commissioner v Construction, Forestry, Mining and Energy Union (2018) 262 CLR 157 ; [2018] HCA 3

- Australian Building and Construction Commissioner v Construction, Forestry, Mining and Energy Union (2017) 254 FCR 68; [2017] FCAFC 113

- Australian Building and Construction Commissioner v Pattinson (2022) 274 CLR 450; [2022] HCA 13

- Australian Competition and Consumer Commission v Employsure Pty Ltd (2023) 407 ALR 302; [2023] FCAFC 5

- Australian Competition and Consumer Commission v MSY Technology Pty Ltd (2012) 201 FCR 378 ; [2012] FCAFC 56

- Australian Securities and Investments Commission v AGM Markets Pty Ltd (in liq) (No 3) (2020) 275 FCR 57; [2020] FCA 208

- Australian Securities and Investments Commission v Camelot Derivatives Pty Ltd (in liq) (2012) 88 ACSR 206; [2012] FCA 414

- Australian Securities and Investments Commission v FIIG Securities Ltd [2026] FCA 92

- Australian Securities and Investments Commission v Lanterne Fund Services Pty Limited [2024] FCA 353

- Australian Securities and Investments Commission v National Australia Bank Ltd (2022) 164 ACSR 358; [2022] FCA 1324

- Australian Securities and Investments Commission v RI Advice Group Pty Ltd (2022) 160 ACSR 204 ; [2022] FCA 496

- Australian Securities and Investments Commission v Youi Pty Ltd [2020] FCA 1701

- Carbone v Fowler Homes Pty Ltd [2024] NSWCA 192

- Re Macquarie Securities (Australia) Ltd [2026] NSWSC 202

- Re Trade Practices Commission v CSR Ltd [1990] FCA 521

Nature of the application

The parties have reached agreement as to the terms on which they seek the resolution of this proceeding. Broadly, Fortnum admits, for the purposes of these proceedings, that, between 20 April 2021 and 11 May 2023 ( “ Relevant Period ” ) , it failed to do all things necessary to ensure that the financial services covered by its Australian financial services l icence ( “ AFSL ” ) were provided efficiently, honestly and fairly, where it failed to implement an adequate cybersecurity policy to manage and mitigate cybersecurity risks faced by it and its authorised representatives ( “ A R s ” ) and failed to implement any adequate processes, systems or frameworks for the oversight and monitoring of its ARs in terms of cybersecurity risk and cyber resilience, and thereby contravened s 912A(1)(a) of the Corporations Act 2001 ( Cth ) ( “ Act ” ). Also for the purposes of these proceedings, Fortnum admits that, during the Relevant Period, it failed to have available adequate human resources to provide the financial services covered by the l icence, by its failure to have personnel with adequate specialised experience or expertise in cybersecurity, and thereby contravened s 912A(1)(d) of the Act ; and failed to have in place adequate risk management systems in respect of cybersecurity and cyber resilience, and thereby contravened s 912A(1)(h) of the Act .

The parties agree that, in these circumstances, Fortnum contravened s 912A(5) of the Act . They propose that several declarations of contravention should be made under s 1317E of the Act ; that Fortnum should be order ed to pay a pecuniary penalty in the total amount of $1.35 million; and that Fortnum should also be order ed to pay ASIC ’ s costs of the proceeding, fixed in the sum of $250,000. I will make those orders , for the reasons set out below.

In this judgment, I have drawn on the parties ’ joint Statement of Agreed Facts and Admissions dated 4 September 2026 ( “ SAFA ” ) and on the joint submissions made jointly by Mr Hewitt, Mr O’Mahoney and Ms Hall on behalf of ASIC and Ms Ellicott and M s Zhu on behalf of Fortnum.

Agreed factual background

I first set out below a summary of the relevant factual background, drawn from the SAFA and t he parties ’ joint submissions, and set out the details of each of the contraventions admitted by Fortnum. It is not necessary to address these matters in the detail set out in the agreed statement, and I have omitted certain matters that are the subject of suppression orders, where disclosure may have undermined the efficacy of additional steps now taken by Fortnum to address cyber risk. Each of the matters noted below should be understood as matters agreed between the parties for the purposes of these proceedings only, on which I consider I may properly proceed.

Fortnum’s business and exposure to cyber risk

As I noted above, Fortnum is and was at all material times the holder of an AFSL which authorised Fortnum to, among other things, provide financial product advice ; and it carries on , and at all material times carried on , a financial services business.

During the Relevant Period, Fortnum ’ s board comprised five directors, namely Mr Neil Younger, its Chief Executive Officer, and four non-executive directors. The b oard had several committees, including a Risk & Compliance Committee ( “ RCC ” ), which met monthly. Mr Younger was the Head of the RCC and other members of the RCC were Fortnum ’ s Head of Advice and its Head of Operations.

At all material times, Fortnum has provided financial product advice, including personal advice (within the meaning of s 766B of the Act ) to retail clients (within the meaning of s 761G of the Act ) ( “ Retail Clients ” ) through ARs, who have provided financial services on Fortnum ’ s behalf pursuant to s 916A of the Act . Fortnum itself did not employ staff that provided personal advice.

At all material times, Fortnum ’ s ARs have comprised firms which operate financial advice businesses ( “ Principal Practices ” ) and individual advisers who are authorised by the Principal Practices ( “ Authorised Advisers ” ). Fortnum ’ s relationship with its Principal Practices was governed by the Principal Practice Agreement, which was entered into by Fortnum and each Principal Practice. Fortnum ’ s relationship with each Authorised Adviser was governed by the Adviser Deed, which was entered into by Fortnum, the Authorised Adviser and the Principal Practice which authorised the Authorised Adviser.

At all material times, the terms of the Principal Practice Agreement provided, inter alia, that Fortnum must have documented policies and guidelines, which must be reasonably available to the Principal Practice and the Authorised Advisers on Fortnum ’ s intranet; and the Principal Practice must at all times comply with Fortnum ’ s policies and guidelines and all directions given by Fortnum in good faith, in respect of the provision of Services. The term “ Services ” was defined in the Principal Practice Agreement as making a recommendation in respect of the issue, variation, termination or disposal of a financial product or financial service; or arranging or facilitating the issue, variation, termination or disposal of a financial product or financial service; or providing any other service of a kind approved by Fortnum in writing; and in respect of a particular Authorised Adviser, was defined as each of these matters , subject to any restrictions or modifications specified in the Adviser Deed or the Authorised Adviser's authorisation certificate. That agreement also provided that the Principal Practice must ensure , at all times , that each Authorised Adviser is aware of the obligations that they and the Principal Practice have under Fortnum ’ s policies and guidelines; the Principal Practices must not, and must ensure that Authorised Advisers do not, without Fortnum ’ s prior written consent , use computer software that has not been approved by Fortnum in writing or use a website in respect of Services that has not been approved by Fortnum in writing; and Fortnum is responsible for providing professional development to the Principal Practice s and Authorised Advisers, as required by applicable laws, in respect of the provision of Services.

At all material times, in the course of providing financial services on Fortnum ’ s behalf, Fortnum ’ s ARs electronically received, stored and accessed confidential and sensitive personal information and documents in relation to Retail Clients, including personal details; information; copies of identification documents; tax file numbers; and financial information, including bank account and credit card details ( “ Personal Information ” ). Fortnum ’ s ARs were obligated to collect confidential and sensitive personal information and documents in accordance with their obligations under anti-money laundering regulations (including the types of information specified above) and required this information in order to be able to provide financial product advice to their clients, to deal in financial products on behalf of their clients and to otherwise receive payment for financial product advice.

At all material times, by reason of the matters noted in paragraph 11 above , [1] Fortnum and each of its ARs were potential targets for cyber-related attacks and cybercrime. The consequences of a cyber-related attack or cybercrime incident could include serious harm and loss to Fortnum, its ARs, and its ARs ’ Retail Clients, including a third party engaging in fraudulent and potentially criminal activity; unauthorised access to, and publication, dissemination or use of, Retail Clients ’ Personal Information; Fortnum ’ s or its ARs ’ systems being compromised in such a way that the systems and/or the data contained within those systems are in some way damaged, altered, or made temporarily or permanently inaccessible; Fortnum ’ s or its ARs ’ ability to provide the financial services covered by the l icence being hindered; and financial loss to Fortnum, its ARs, or its ARs ’ Retail Clients as a result of any of the above.

At all material times, Fortnum was aware that it and its ARs were potential targets for cyber-related attacks and cybercrime; that a cyber-related attack or cybercrime incident could result in serious harm and loss to it, its ARs, and its ARs ’ Retail Clients; and that the adoption of measures to improve cybersecurity and cyber resilience could mitigate the risk of a cybersecurity incident and the consequences of a cyber-related attack or cybercrime incident.

In particular, Fortnum was aware of the risks identified in paragraph 13 above in circumstances where, at all material times, Fortnum knew, or ought to have known, several matters as follows:

(a) In February 2017, the Australian Signals Directorate first published a set of recommended cybersecurity mitigation strategies known as the Essential Eight.

(b) In November 2017, ASIC published Report 555 titled “Cyber resilience of firms in Australia’s financial markets” which provided a snapshot of the cyber resilience of firms operating in Australia’s financial markets, identified key trends from self-assessment surveys, and highlighted existing good practices and areas for improvement.

(c) In or around February 2020, Toll Group experienced a major cyberattack and had to take most of its services offline after hackers locked up its files and demanded a ransom for their release.

(d) In February 2020, a Principal Practice operated by one of Fortnum’s directors experienced a cybersecurity incident arising from a phishing link.

(e) In August 2020, ASIC commenced proceedings against RI Advice Group for failing to have cybersecurity systems following nine cybersecurity incidents at certain ARs, including a “brute force” attack whereby a malicious user successfully gained remote access to an authorised representative’s server which contained sensitive client information, including identification documents.

(f) On or around 26 January 2021, the email address of an Authorised Adviser of one of Fortnum’s then-Principal Practices was compromised by malware, with the result that a spam email was sent to the Authorised Adviser’s email contacts.

(g) In or around late March or April 2021, the email address of an employee of one of Fortnum’s then-Principal Practices was accessed without authorisation by an overseas IP address. An email forwarding rule was created and subsequently removed 26 hours later during which time 16 emails were sent but returned as unsuccessful.

(h) On or around 1 July 2021, the email address of an AR of one of Fortnum’s then-Principal Practices was accessed and an impersonation email was sent to certain Fortnum staff, apparently attempting to gain unauthorised access to Fortnum systems.

(i) In early May 2022, judgment was handed down in respect of the proceedings commenced by ASIC against RI Advice Group, where the Court found that RI Advice Group had contravened ss 912A(1)(a) and (h) of the Act .

(j) On or around 26 July 2022, two employees of one of Fortnum’s Principal Practices clicked on malicious phishing links which resulted in an unknown threat actor gaining access to at least one employee’s email account and sending 1,266 emails containing phishing links from that employee’s account. Fortnum was aware of the incident by no later than 30 August 2022.

(k) In September 2022, Optus experienced a major data breach, which was widely publicised.

(l) In October 2022, Medibank Private experienced a major data breach, which was widely publicised.

(m) In the period from 5 September 2022 to 20 September 2022, one of Fortnum’s Principal Practices, Wealthwise , experienced a major data breach which resulted in the exfiltration and publication of over 200 gigabytes of data relating to up to 9,828 clients. These were primarily clients who had been serviced during the period prior to Wealthwise becoming a Principal Practice of Fortnum, when it was authorised by its former licensee. Fortnum was made aware that a data breach had occurred on around 18 November 2022 and actively monitored the incident management to mitigate the harm to clients. Fortnum was informed by Wealthwise that there was no evidence of any client data loss on 9 December 2022. Fortnum was subsequently made aware that a significant amount of data had been released onto the dark web on or around 2 March 2023. Fortnum reported the incident to ASIC on 30 March 2023, and assisted Wealthwise with the preparation of a report lodged with the Office of the Australian Information Commissioner by Wealthwise on 30 March 2023.

The scope of Fortnum’s obligations in respect of cybersecurity

The parties agree several matters as to the scope of Fortnum ’ s obligations in respect of cybersecurity, which seem to me to be consistent with the case law. At all material times, as the holder of an AFSL, Fortnum was required to establish and maintain compliance measures that ensured, as far as was reasonably practicable, that Fortnum complied with the provisions of the financial services laws.

At all material times, pursuant to the provisions of the financial services laws, Fortnum was required (among other things) to: do all things necessary to ensure that the financial services covered by the licence were provided efficiently, honestly and fairly, pursuant to s 912A(1)(a) of the Act ; have available adequate resources, including financial, technological and human resources, to provide the financial services covered by the l icence and to carry out supervisory arrangements, pursuant to s 912A(1)(d) of the Act ; and have adequate risk management systems, pursuant to s 912A(1)(h) of the Act .

To comply with these obligations, Fortnum was required to identify the risks that it and its ARs, in the course of providing financial services on Fortnum ’ s behalf, faced in relation to cybersecurity and cyber resilience; have strategies, frameworks, policies, plans, procedures, standards, guidelines, systems, resources and controls in place in respect of cybersecurity and cyber resilience that were adequate to manage and mitigate those risks, having regard to Fortnum ’ s business as a whole, its relationship with its ARs and the size of, and resources available to, each of Fortnum and its ARs; and implement and maintain those strategies, frameworks, policies, plans, procedures, standards, guidelines, systems, resources and controls to manage and mitigate those risks.

Fortnum’s policies in respect of cybersecurity

On 20 April 2021, Fortnum issued a policy to its ARs entitled “ Cyber Security Policy Version 1.0 ” ( “ April 2021 Policy ” ). The April 2021 Policy was the first policy implemented by Fortnum which was specifically directed at cybersecurity.

Prior to 20 April 2021, Fortnum ’ s other policies and systems addressed aspects of information security and/or cybersecurity. In particular, the Document Retention Policy required Principal Practices to store sensitive client information and key advice records in a particular third-party IT system called Xplan . Xplan had certain security measures in place and was administrated centrally by Fortnum. Fortnum also had policies providing that Fortnum would monitor Principal Practices ’ compliance with the Document Retention Policy.

In the Relevant Period, the April 2021 Policy was the primary policy in effect by which Fortnum sought to manage and mitigate the cybersecurity risks faced by its A R s , and operated alongside the Document Retention Policy and other policies and guidance.

The April 2021 Policy was developed by Fortnum ’ s Head of Technology with input and feedback from the Fortnum Leadership Team and approved by the RCC.

Fortnum did not formally retain any third parties with cybersecurity experience or expertise to assist with the development of the April 2021 Policy. However, it did have some consultation with IT consultants, including external IT consultants, and its ARs during the development process. I have had regard to the agreed facts as to those consultations , but it is not necessary to set them out in order to determine this application.

The April 2021 Policy required that all Principal Practices take certain steps in respect of cybersecurity ( “ Essential Strategy ” ) , including by “ implementing some key action items to reduce the risk of cyber security event s ” . The April 2021 Policy also noted other steps that would be implemented centrally by Fortnum, including the implementation of multi-factor authentication in respect of Xplan (which , as I noted above, was stated to be the main and mandated repository for client personal information and was centrally administered by Fortnum) and Docusign from 1 April 2021. It also contained recommendations for additional optional steps that could be taken for “ t hose wanting a more comprehensive cybersecurity strategy based on the enterprise framework set by Australian Cyber Security Centre ” ( “ Advanced Strategy ” ). The steps contemplated by the Advanced Strategy were aligned with the Australian Cyber Security Centre ’ s “ Essential Eight Maturity Model ” ( “ ACSC Essential Eight ” ). The Advanced Strategy was modelled off Maturity Level 1 of the ACSC Essential Eight for small to medium enterprises.

Pursuant to the April 2021 Policy, and as part of the Essential Strategy:

(a) by 1 September 2021, all Principal Practices were required to complete a self-assessment tool, which involved a series of questions regarding the Principal Practices ’ cybersecurity and IT set-up with the available responses being “ yes ” , “ no ” , or “ unsure ” ( “ Self-Assessment ” ); engage with either Fortnum or an IT consultant regarding those questions in the Self-Assessment to which the Principal Practice responded “ no ” or “ unsure ” ; and complete a form confirming the cybersecurity measures that had been implemented ( “ Attestation ” ); and

(b) Fortnum was to conduct an annual review in September of each Principal Practices’ cybersecurity strategy, with the first annual review to take place from September 2022.

The April 2021 Policy did not mandate that Principal Practices consult or otherwise engage with Fortnum where they had responded “ no ” or “ unsure ” to any question in the Self-Assessment. It allowed Principal Practices to consult or otherwise engage with a consultant where they had responded “ no ” or “ unsure ” to any questions in the Self-Assessment in circumstances where Fortnum had no policies, processes or systems in place to ensure that such consultants had adequate and appropriate experience and expertise. It did not mandate that Principal Practices uplift or otherwise change their practices in respect of those questions in the Self-Assessment to which they had responded “ no ” or “ unsure ” ; only included mitigation strategies, such as those set out in the ACSC Essential Eight, as part of the optional Advanced Strategy; and did not require Principal Practices to take steps, as part of the Essential Strategy, which were adequate to manage and mitigate the cybersecurity risks faced by Fortnum and its ARs.

In light of the matters referred to in paragraph 25 above, the April 2021 Policy was not adequate to manage and mitigate the cybersecurity risks faced by Fortnum and its ARs.

Turning now to the implementation of the April 2021 Policy, in the period from 20 April 2021, Fortnum did not ensure that its Principal Practices completed the Self-Assessment and the Attestation, as required by the April 2021 Policy.

In the period from 1 September 2021 to 31 January 2023, Fortnum received a further 9 completed Self-Assessment forms and a further 15 completed Attestation forms.

The b oard of Fortnum was aware that there had been low completion rates for both the Self-Assessment and the Attestation by at least 5 September 2022. On that date, Fortnum ’ s Head of Technology sent an email to Mr Younger which recorded the completion rates. In particular, as at 5 September 2022, Fortnum had received completed responses to the Self-Assessment from only 44 Principal Practices (or approximately 54% of the total number of Principal Practices as at that date); and completed responses to the Attestation from only 22 Principal Practices (or approximately 27% of the total number of Principal Practices as at that date).

The Self-Assessment and the Attestation were the primary processes which Fortnum had in place to monitor whether Principal Practices had implemented, and were complying with, the April 2021 Policy.

Of the responses to the Self-Assessment which Fortnum received, 16 of the 50 practices indicated they were implementing the policy “ DIY ” , that is, without the assistance of an IT consultant; and a further 7 of the 50 practices did not respond to that question regarding implementation. Six of the 50 practices indicated that they were “ unsure ” if the software they were using was on Fortnum ’ s approved technology list. Six of the 50 practices answered “ no ” , and 2 answered “ unsure ” , to the question “ have you educated your staff on cyber security and have a good cyber culture ” ; and every question had at least one “ no ” or “ unsure ” response.

Fortnum had no formal processes in place for engagement with the ARs who responded “ no ” or unsure ” to any of the questions in the Self-Assessment in order to ensure that any issues identified in the Self-Assessment (including those identified in paragraph 32 above) were resolved.

In the period from May to July 2022, Fortnum decided to develop an update to the April 2021 Policy. That decision was made by Mr Younger in his capacity as CEO of Fortnum. The decision was made because Fortnum wished to improve its policy framework and reflected an evolving understanding of the nature and extent of cybersecurity risks faced by Fortnum and its ARs.

The steps which Fortnum took towards developing an update to the April 2021 Policy included:

(a) from at least May 2022, Fortnum conducted a review of the April 2021 Policy to consider how the policy could be updated and improved;

(b) on 14 July 2022, the Fortnum b oard noted that Fortnum was considering initiatives to “tighten” its policy settings in relation to cyber security; and

(c) on 27 September 2022, the Fortnum board accepted recommendations to strengthen the control environment and uplift its cyber policy by developing an update to the April 2021 Policy.

In connection with the decision to develop an update to the April 2021 Policy, Fortnum also decided at some point in the period prior to July 2022, not to take any steps to require Principal Practices to complete the Self-Assessment or the Attestation; and not to conduct, or take steps to require its Principal Practices to conduct, an annual review of the Principal Practices ’ cybersecurity strategy, as required by the April 2021 Policy. As a result, Fortnum did not conduct, or require its Principal Practices to conduct, an annual review of the Principal Practices ’ cybersecurity strategy in or around September 2022, or at all.

On 18 May 2022, one of Fortnum ’ s ARs sent an email to Fortnum ’ s Head of Technology and other staff, in connection with an article discussing the decision in the Australian Securities and Investments Commission v RI Advice Group Pty Ltd (2022) 160 ACSR 204; [2022] FCA 496 ( “ RI Advice ” ) proceeding. Fortnum ’ s Head of Technology responded:

“Whilst we have a Cyber policy in place based on the ACSC guidelines and essential eight strategy, we have been spending some time on any gap analysis we may have off the back of the RI Advice findings.

We are reviewing the program from a policy setting and support but also how we manage our obligations of compliance of the policy with practices.

[The CEO of Fortnum] is indeed attending the Licensee Summit and we are currently having conversations with a number of other dealer groups a consolidated approach. This group is also in a strong position to provide feedback to ASIC on the practical application of this approach. [The CEO of Fortnum] also has a relationship with [the CEO of RI Advice] should we need more information, thank you for the offer.

We will be in more of a position to communicate and plan forward, post these discussions. We will certainly provide some more guidance shortly. If you need anything else please let me know.”

The minutes of an RCC meeting held on 2 June 2022, recorded the following:

“ The committee questioned where we Fortnum are at with Cyber Risk – has Fortnum taken all necessary steps?

Work in training, tech APL, two factor authentication in client data pools. Have we taken all necessary steps? Consider test case adjudicated most recently with RI.

Actions we are taking:

[Head of Technology] is writing a paper based upon above findings, what other things could we do that we haven’t done so far. Go to the [b]oard. Separate Risk re Director Obligations. Determine organisationally what we believe we need to do further and enact a plan to implement.

1 Encryption. [redacted] 3. Supervision of advisers

Compliance APL obligations and own internal processes around Governance, training. Compliance implantation 2 factor authentication and potentially encryption.

Audit oversight/robust testing.”

On 14 July 2022, a Group CEO report was prepared for the Fortnum b oard. That paper noted that “ Cyber is a risk area that the business has been working on. With the recent ASIC test case with RI, we need to look at the level of controls and ensure we have an appropriate management framework in place ” . Subsequently, under the heading “ Cyber ” , the paper set out Fortnum ’ s current position and current recommendations. I have regard to but need not set out the detail of those matters.

On 27 September 2022, a report was prepared for the Fortnum b oard on cybersecurity. I also have regard to but need not set out the detail of that report.

The minutes for that 27 September 2022 b oard meeting record, under the heading “ Cyber ” :

Recommendations accepted

Resolution to mandate [redacted]

Need to think implementation and clients perspective

What’s expected at the clients end?

Board encouraged to move to implement.”

On 31 March 2023, a report was prepared for the Fortnum b oard on cybersecurity and the 31 March board meeting record ed a discussion of that report . I again have regard to but need not set out the detail of that report and that discussion .

On 11 May 2023, Fortnum issued a policy to its ARs entitled “ Cyber Policy Version 2.1 ” ( “ May 2023 Policy ” ). The period of contravention in issue in the application ends with the issue of that policy.

Notwithstanding that Fortnum knew there had been low completion rates of the Self-Assessment and Attestation under the April 2021 Policy; knew that the Self-Assessment and Attestation were the only processes which Fortnum had in place to monitor whether Principal Practices had implemented and were complying with the April 2021 Policy; and had identified specific aspects of the April 2021 Policy which ought be uplifted or improved, as set out in paragraphs 3 7 to 42 above, Fortnum did not implement any substantive measures additional to the April 2021 Policy and other existing policies such as the Document Retention Policy to manage and mitigate cybersecurity risks for it or its ARs in the period between the introduction of the April 2021 Policy and the May 2023 Policy.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fortnum Private Wealth Fined AU$1.35M for Cybersecurity Negligence Fortnum Private Wealth has been fined AU$1.35 million by the Supreme Court of New South Wales for failing to manage cybersecurity risks adequately across its network of financial advisers. The company admitted to negligence that could have exposed its representatives and approximately 55,000 retail clients to cyber-related attacks between April 2021 and May 2023. The Australian Securities and Investments Commission (ASIC) initiated proceedings after being notified of a cyber attack against one of Fortnum's representatives in July 2025. Justice Ashley Black stated that the penalty reflects the need for specific and general deterrence, given the scale of Fortnum's operations. Fortnum's CEO noted that no client or adviser loss was identified due to these failures. The fine also includes an additional AU$250,000 towards ASIC's costs. This case marks the third enforcement action by ASIC against a licensee for similar cybersecurity failures. 3 sources 28

Extracted Entities

1a12d6ac04ac2ea4d89d2fa3

The full story

Extracted Entities

Companies (1)

Countries (1)

Domains (2)

Industries (1)