ASIC secures second cybersecurity penalty in eight months as Fortnum is ordered to pay $1.35 million

Sharpening focus on cybersecurity 6 min read

The Australian Securities and Investments Commission (ASIC) has secured its second cybersecurity penalty in eight months after the Supreme Court of New South Wales approved an agreed $1.35 million penalty against Fortnum Private Wealth Ltd (Fortnum) for inadequate cybersecurity policies, systems and oversight across its network of authorised representatives (ARs).

The Fortnum outcome follows a $2.5 million penalty against FIIG Securities in February and an open letter from ASIC in May urging boards to strengthen cyber resilience as frontier AI accelerates threats. Together, these developments signal an ongoing regulatory and enforcement focus by ASIC on cybersecurity.

Key takeaways

For licensees, the decision holds three key takeaways:

1. a cybersecurity policy must be properly implemented, monitored and enforced rather than left as a paper exercise;
2. licensees need specialised cybersecurity expertise, whether in-house or formally engaged, not ad hoc IT input; and
3. risk management frameworks must address cybersecurity and cyber resilience in substance, not just in general terms.

Background

Fortnum holds an Australian financial services licence (AFSL) and provides product advice to retail clients through a network of principal practices and authorised advisers, which handle sensitive client data and are exposed to cybersecurity risk.

Fortnum admitted that despite a series of warning signs between 2020 and 2023, its first cybersecurity policy, introduced in April 2021, was inadequate and was not effectively implemented or monitored from 20 April 2021 to 11 May 2023 (Contravention Period).

During this time, one of Fortnum's principal practices, Wealthwise, suffered a significant cyber incident involving the exfiltration and later publication of data relating to as many as 9,828 clients. Fortnum became aware of the incident in November 2022, and after learning in March 2023 that the data had been published on the dark web, reported the incident to ASIC and helped Wealthwise notify the Office of the Australian Information Commissioner.

In the proceedings, Fortnum admitted that, during the Contravention Period it:

• failed to do all things necessary to ensure that its financial services were provided efficiently, honestly and fairly by its failure to:
  • implement an adequate cybersecurity policy to manage and mitigate cybersecurity risks for itself and its ARs; and
  • implement any adequate processes, systems or frameworks for the oversight and monitoring of its ARs in terms of cybersecurity risk and cyber resilience;
• failed to have available adequate human resources; and
• failed to have adequate risk management systems in respect of cybersecurity and cyber resilience,

in contravention of sections 912A(1)(a), (d) and (h), and 912A(5A) of the Corporations Act 2001 (Cth).

Where Fortnum fell short

Cybersecurity policies are only as effective as their content, implementation and monitoring

Fortnum had a cybersecurity policy during the Contravention Period, but it was inadequate and not effectively implemented or monitored. The policy required principal practices to take certain steps but did not require identified deficiencies to be remediated. Fortnum relied on self-reporting despite low completion rates, with no formal follow-up if a practice reported non-compliance or was unsure whether it had complied.

Fortnum's board and senior management were repeatedly notified of low compliance and the need to strengthen cyber settings, and principal practices had sought guidance on cybersecurity issues. Yet Fortnum introduced substantive additional measures only in May 2023.

Failing to employ or engage staff with cybersecurity expertise may breach the adequate resources obligation

Fortnum's cybersecurity policy was developed internally by its head of technology, who lacked formal cybersecurity training. Although Fortnum engaged external IT consultants and its ARs during development, it did not formally engage a third party with specialised cybersecurity expertise. None of Fortnum's 22 to 32 employees during the Contravention Period held specialised cybersecurity qualifications.

Risk management systems must address cyber risk in substance

Fortnum had a broad risk management framework, including a risk appetite statement, risk register and incident reporting requirements for its ARs, but these did not adequately address cybersecurity and cyber resilience.

The deficiencies concerned identifying and evaluating cybersecurity risks, controls for managing those risks, allocating cybersecurity responsibilities between Fortnum and its ARs, and escalating cybersecurity issues.

Penalty

The Court ordered Fortnum to pay a $1.35 million pecuniary penalty, together with $250,000 towards ASIC’s costs. In determining the appropriate penalty, the Court considered the following factors:

1. Course of conduct: Fortnum's three contraventions carried a maximum penalty of $33.3 million but were treated as two courses of conduct. The $1.35 million penalty was well below that theoretical maximum, and, unlike the FIIG judgment, this judgment does not set out a numerical formula or benchmark for the figure reached.
2. Nature and extent of the contraventions: The contraventions were serious, multi-layered and continued for almost two years despite the board's awareness of the need to strengthen Fortnum's cybersecurity policy, though the contraventions were not deliberate.
3. Loss or damage: ASIC did not allege any loss caused by the contraventions, and Fortnum did not derive any profit or benefit from them.
4. Size and financial position: Fortnum employed 22 to 32 full-time employees and had 81 to 94 principal practices in its network. The company had recorded losses or minimal profits in most recent years. Its relatively small scale and financial position were mitigating factors.
5. Prior conduct: Fortnum had not previously been found to have engaged in similar conduct or been involved in any significant regulatory matters.
6. Cooperation and remediation: Fortnum cooperated with ASIC's investigation, admitted the contraventions and sought to resolve the proceeding. It had also strengthened its cybersecurity arrangements since the Contravention Period, including policy updates, annual third-party reviews and regular cybersecurity training.
7. No compliance order: Despite the scale and duration of the contraventions, the Court did not order a court-supervised compliance program, instead treating Fortnum's post-Contravention remediation and ongoing uplift work as a mitigating factor.

What this means for regulated financial services and credit licensees

1. Cybersecurity remains a continuing ASIC focus. This is ASIC's third successful enforcement outcome against an AFSL holder for inadequate cybersecurity. The first was RI Advice Group in 2022, where no pecuniary penalty was imposed (part of the contravention period pre-dated s 912A(1)(a) becoming a civil penalty provision). The second was FIIG Securities, who was ordered to pay $500,000 towards ASIC's costs along with a $2,5 million penalty. We expect continued enforcement in this space.
2. A policy alone is not enough; it must be implemented, monitored and enforced. Fortnum's policy was ineffective because it did not require principal practices to remediate identified gaps, relied on unverified self-reporting with no follow-up and only recommended (rather than mandated) alignment with the Australian Signals Directorate's Essential Eight. These shortcomings were central to the findings against Fortnum.
3. Specialised cybersecurity expertise is required. Fortnum's policy was developed internally by its head of technology, who had no formal cybersecurity training. Ad hoc or informal consultation with external IT consultants was not sufficient. Licensees need access to appropriate cybersecurity expertise, whether in-house or through suitably qualified third parties.
4. Ongoing remediation can mitigate a penalty. Fortnum's improvements to its cybersecurity posture were treated as a mitigating factor, and no court-supervised compliance program was ordered, demonstrating the value of genuine, sustained remediation in an enforcement situation.

What steps should organisations take

The Fortnum decision is a clear signal that ASIC expects regulated entities to treat cybersecurity as a core governance and risk management obligation, not a technical afterthought. Organisations should take this opportunity to test their own arrangements against the gaps identified in Fortnum, and to act promptly on any shortcomings identified.

1. Review cyber governance arrangements. Ensure cyber risk is a board and senior management issue, not just an IT issue.
2. Assess cyber policies. Check whether policies require remediation of identified gaps, and confirm that policies are actually being monitored and enforced.
3. Review oversight frameworks. This is particularly important where third parties, authorised representatives, franchisees, distributors or subsidiaries are involved.
4. Assess cyber expertise. Determine whether the organisation has appropriate internal cyber capability or has formally engaged external specialists.
5. Review risk management frameworks. Ensure cyber risk is specifically identified, assessed, escalated and managed within broader risk systems.
6. Action remediation. Address identified gaps and document ongoing uplift activity.