When ASIC fines AFSL holder businesses over cyber security, every licensee should sit up and take notice. This time the penalty is $1.35 million, and it has Fortnum Private Wealth’s name on it. The Supreme Court of New South Wales handed it down after Fortnum admitted it failed to properly manage cyber security risk across its financial advice network.
The story starts back in 2022. Attackers got into one of Fortnum’s authorised representatives, and the personal data of more than 9,000 clients ended up published on the dark web.
Four years later, the bill has arrived.
That slow fuse matters as much as the dollar figure. It shows how patiently this regulator works, and it tells every AFSL holder in insurance, advice and broking exactly what ASIC is measuring when it comes knocking.
This ASIC Cyber Security Fine Isn't a One-Off
If this feels familiar, it should. Fortnum is the third name on a growing list FocusNet has been tracking for this audience.
Australian Clinical Labs was hit with $5.8 million under the Privacy Act for failing to protect sensitive health data. FIIG Securities copped $2.5 million under its AFS licence after known weaknesses sat unfixed for more than four years. Now Fortnum joins them. That makes three enforcement actions across health and financial services, all inside roughly a year.
The thread stitching the financial services cases together is section 912A of the Corporations Act. It requires an AFSL holder to provide financial services efficiently, honestly and fairly, and to keep adequate risk management systems in place. Back in 2022, the Federal Court ruled in ASIC v RI Advice that weak cyber security can breach that obligation on its own.
Every new case puts another price tag on that principle. Fortnum isn’t the real story here. The direction of travel is.
ASIC has stopped treating cyber incidents as unlucky events to note and move past. It now treats them as evidence, exhibit A in a case about whether a licensee met its core obligations. And it is more than willing to take that case all the way to court.
Why ASIC Fines AFSL Holder Businesses Years After the Breach
For most business owners, a cyber incident feels over the moment the systems blink back to life and the client letters go out. The servers might be quiet again, but the regulator is only just warming up.
Investigations, findings and court penalties grind along for years. A business trading happily today could still be sitting on exposure from a gap that opened long ago. The breach that revealed it just hasn’t reached the front of ASIC’s queue yet.
This is the trap that catches licensees off guard. Incident response buys you time. It doesn’t buy you closure.
When ASIC finally comes looking, it isn’t only asking what went wrong. It wants to see what your systems looked like the day before it went wrong, and whether they were fit for the data you were holding.
Fortnum shows exactly how that plays out. The court accepted its conduct wasn’t deliberate and that it cooperated with ASIC every step of the way. It still walked away with a $1.35 million penalty, because good intentions can’t paper over controls and oversight that were never strong enough to begin with.
Knowing the Risk Isn't the Same as Managing It
If you run a brokerage, underwriting agency or advice business, don’t file this under someone else’s bad luck. Read it as a clear signal of what the regulator expects from you.
The breach itself touched more than 9,000 clients, but the court cast its net much wider. Fortnum’s failures left a network of around 55,000 retail clients exposed. Section 912A has no client-count threshold, so the obligation follows you whether you look after fifty clients or fifty thousand.
ASIC expects your defences to match the sensitivity and volume of the data in your care. And it expects proof, real evidence that those defences were switched on and doing their job, not just written into a policy.
That’s where plenty of licensees are more exposed than they think. FIIG had policies. What it didn’t have was the people, budget and follow-through to bring them to life for four long years.
Fortnum had a cyber policy too. It knew about the ASD Essential Eight, ASIC’s own cyber guidance and the RI Advice decision. Yet the court found the policy fell short, and that Fortnum had no real way of checking whether its practices were following it.
In other words, Fortnum knew the risks and still couldn’t show it was managing them. That gap between a plan on paper and a control that actually works is precisely what ASIC is now testing in court.
To be clear, FocusNet doesn’t take on a licensee’s regulatory obligations, and no managed service provider can. What a good provider can do is build the systems, monitoring and paper trail that turn those obligations from a promise into proof.
That means patching that stays current, multi-factor authentication on every system that touches client data, tight access controls, backups that are actually tested and staff training that sticks. It also means a clear record of all of it, ready to hand to an auditor, a regulator or your own board without a frantic scramble to rebuild it.
That evidence trail is the difference between a licensee who can show reasonable steps and one who can only talk about them. It sits at the heart of good IT support for brokers and financial services.
Check Your Own House Before ASIC Does
None of this calls for panic. If your systems are genuinely well run, this case changes nothing. But it is a timely nudge to take an honest look and ask whether your setup would survive the kind of scrutiny Fortnum’s didn’t.
Start with the basics. Know exactly where client data lives and who holds the keys. Switch on multi-factor authentication everywhere it’s offered, and keep patching and backups current and tested rather than assumed.
Make staff training regular enough that it actually sticks. Then keep the receipts, documentation that shows all of this has been happening steadily over time, not just since this article landed in your inbox.
If a breach ever does hit, how you respond will still count. But as this case makes clear, the regulator is really weighing the years of groundwork that came before.
Across every one of these cases, building that evidence base properly would have cost a fraction of the penalty that followed. That’s the lesson worth taking into your next board meeting.
References
Australian Securities and Investments Commission v Fortnum Private Wealth Ltd [2026] NSWSC 1252.
insuranceNEWS. (2026, October 14). Advice group cops $1.3m ‘sting’ over cyber failings. https://www.insurancenews.com.au/regulatory-government/advice-group-cops-1-3m-sting-over-cyber-failings
