Cybersecurity failures see Fortnum Private Wealth penalised $1.35m

Financial advice business Fortnum Private Wealth has been ordered by the Supreme Court of NSW to pay a $1.35 million penalty after admitting it failed to adequately manage cybersecurity risks across its financial advice network.

Fortnum also admitted it failed to have adequate cybersecurity expertise and risk management systems, exposing its authorised representatives and their clients to the risk of cyber-related attacks and cybercrime, that could result in serious harm and loss.

ASIC first announced back in July of last year that it was suing Fortnum.

In proceedings filed in the NSW Supreme Court at the time, ASIC alleged several of Fortnum’s authorised representatives (ARs) experienced cyber incidents, including an attack that ASIC alleged led to the data of more than 9,000 clients published on the dark web. 

In today's announcement to the market, ASIC stated that during the relevant period - between 20 April 2021 and 11 May 2023 - Fortnum's network comprised between 81 and 94 financial advice practices, more than 200 authorised advisers, and around 55,000 retail clients.

These practices collected and held highly sensitive personal information, including identification documents, tax file numbers and financial account details.

Fortnum has admitted that during that period, it failed to implement an adequate cybersecurity policy to manage and mitigate cybersecurity risks across its business and authorised representative network, as well as failed to implement adequate processes, systems and frameworks to oversee and monitor the cyber resilience of its authorised representatives.

It also admitted that it failed to maintain adequate human resources with specialised cybersecurity expertise, and also failed to maintain adequate cybersecurity risk management systems.

Since then, Fortnum has uplifted its cybersecurity framework, including introducing mandatory cyber controls, annual reviews, enhanced training and specialist cyber expertise, ASIC said.

ASIC Chair Sarah Court said the outcome reinforced that AFSL holders must properly manage and protect against cybersecurity risk.

"Today’s outcome is the third obtained by ASIC against a licensee over failures to adequately protect against cybersecurity risk, following previous enforcement actions against RI Advice and FIIG Securities," she said.

"In this case, Fortnum was aware of the cybersecurity risks facing its business and authorised representatives but failed to implement an adequate cybersecurity policy and have adequate oversight and monitoring arrangements.

"These failures exposed authorised representatives and their clients to the risk of cyber-related attacks and cybercrime and fell below the standard the public is entitled to expect from an AFSL holder.

‘"This outcome reinforces ASIC’s continued focus on licensees getting the fundamentals right. Strong cyber resilience is critical to maintaining trust and confidence in our financial system. We will continue to work with industry to lift standards and take action where businesses fall short."

"I am satisfied that the proposed pecuniary penalty in the total amount of $1.35 million will provide the necessary sting or burden, given the scale of Fortnum's business, to achieve the objects of specific deterrence and general deterrence," His Honour Justice Black stated.

"That penalty properly reflects the matters agreed between the parties, including the fact that the contravening conduct was not deliberate and that Fortnum has cooperated with ASIC, both during the investigation stage and in the conduct of this proceeding."

Justice Black noted that the parties had agreed that as a result of its failures Fortnum exposed its authorised representatives and their retail clients to "...the risk of cyber-related attacks and cybercrime, the consequences of which could include serious harm and loss."

The Court also ordered Fortnum to pay $250,000 towards ASIC's costs.