ASIC v Fortnum Private Wealth: NSW Supreme Court orders a $1.35 million penalty (plus $250,000 costs) after the AFS licensee admitted inadequate cyber security across its adviser network — ASIC's third cyber-resilience outcome after RI Advice and FIIG
ASIC said on 14 October 2026 (media release 26-244MR) that the Supreme Court of NSW has ordered Fortnum Private Wealth Ltd, a Sydney-based financial advice licensee, to pay a $1.35 million penalty and $250,000 towards ASIC's costs. Fortnum admitted that between 20 April 2021 and 11 May 2023 it failed to implement an adequate cybersecurity policy across its business and authorised-representative network; failed to have adequate processes, systems and frameworks to oversee and monitor its representatives' cyber resilience; failed to maintain adequate staff with specialised cybersecurity expertise; and failed to maintain adequate cybersecurity risk-management systems. Over that period the network had 81 to 94 financial advice practices, more than 200 authorised advisers and around 55,000 retail clients, whose files included identification documents, tax file numbers and financial account details. Justice Black said the agreed penalty provides the 'necessary sting or burden' for deterrence, noting the conduct was not deliberate and Fortnum cooperated with ASIC. ASIC Chair Sarah Court called it the third outcome ASIC has obtained against a licensee over cyber-risk failures, after RI Advice and FIIG Securities, and said Fortnum knew the risks but lacked an adequate policy and oversight. ASIC began the case in July 2025 after Fortnum notified it of a cyber attack on one of its authorised representatives. ASIC's 2025 filing alleged that one attack on a representative led to a major breach in which the data of more than 9,000 clients was published on the dark web. Fortnum has since introduced mandatory cyber controls, annual reviews, enhanced training and specialist cyber expertise. Primary: ASIC 26-244MR; background: ASIC 25-143MR; wire: Cyber Daily.
- Product
- Australian financial services licensees: cyber-resilience obligations across authorised-representative networks
- Versions
- n/a — enforcement outcome (conduct 20 Apr 2021 – 11 May 2023; Supreme Court of NSW, Justice Black)
- Exploited in Australia?
- unknown
- Patch to
- AFS licensees and other businesses that run representative or franchise networks: adopt a cyber policy that binds every representative; set minimum controls (MFA, patching, backups, protection of client ID and TFN records) and annual training; monitor and audit representatives against them; and have staff or advisers with real cyber expertise. Boards: treat the RI Advice, FIIG and Fortnum outcomes as ASIC's enforcement baseline.
Primary: ASIC — 26-244MR Fortnum Private Wealth penalised $1.35 million for cybersecurity failures (14 Oct 2026) · Vendor: ASIC — 25-143MR ASIC sues Fortnum Private Wealth (July 2025; proceedings history) · Cyber Daily — Fortnum Private Wealth cops $1.35m fine over cyber security failures (14 Oct 2026)