Fortnum Private Wealth has been ordered to pay a $1.35 million penalty for cybersecurity failures across its financial advice network, with another $250,000 towards ASIC's legal costs. It admitted its policies and oversight of authorised representatives were inadequate. It also lacked sufficient cybersecurity expertise and risk management. With advice delivered through many separate practices, confidence in head office's own technology would be a poor basis for judging how safely client records were being handled elsewhere.
ASIC's announcement on 14 October puts the network at 81–94 practices, more than 200 advisers and around 55,000 retail clients during the relevant period. The practices held identification documents, tax file numbers and financial account details. ASIC brought proceedings after Fortnum notified it of an attack affecting an authorised representative. Those network figures are not a count of breach victims, and the outcome does not mean every practice was compromised.
In the judgment and orders, made by Justice Black in the NSW Supreme Court on 12 October, the Court accepted agreed facts and admissions covering 20 April 2021 to 11 May 2023. It recognised Fortnum's cooperation and subsequent improvements, including specialist reviews of practices, and that the conduct was not deliberate. ASIC identified no specific loss caused by the contraventions. The penalty addressed established failures in managing risk; it was not imposed merely because an attack occurred. ASIC describes this as its third cybersecurity enforcement outcome against a licensee, after RI Advice and FIIG Securities.
Head office cannot see everything from its own dashboard
The judgment records a policy relying on self-assessments and attestations, without requiring practices to fix gaps they identified. Only 11 practices, approximately 12%, had completed the attestation by the initial deadline. There were no formal processes to ensure issues flagged by “no” or “unsure” answers were resolved.
That leaves a substantial distance between publishing a policy and knowing what protection exists. An unanswered form tells the licensee very little. A completed one can still conceal a misunderstanding, especially if the person filling it in has been asked to judge settings they do not administer. Treating either as a satisfactory endpoint puts too much weight on paperwork.
Consider a hypothetical advice practice using its own Microsoft 365 environment and a local IT provider. The licensee might operate a well-managed central document platform while the practice's email has different administrators and access rules. Clients can still send attachments to those mailboxes. Oversight has to reach the systems actually involved in delivering advice, including the ones outside central administration.
A statement that MFA is enabled might describe staff enrolment rather than an enforced requirement. Microsoft's guidance on per-user MFA states explains that policy-based enforcement can operate without changing those states. A status column alone can therefore give the wrong answer. Someone familiar with the configuration needs to check whether the protection applies to email and administrator access, including any exceptions.
That review needs to include privileged accounts used by the external IT provider, whose permissions may let them change other people's access. It also needs to establish what happens when a technician or practice employee leaves. A current staff list provides little evidence that former staff can no longer open client files.
These examples are separate from the findings about Fortnum. A small practice could work through them with its existing IT provider, bringing in specialist help where needed. If a problem cannot be resolved locally, the licensee needs to hear about it and decide what happens next. Leaving that decision with someone who cannot interpret the configuration is unlikely to produce a useful answer.
The client's records pass through more than one office
A private client may be careful with their own devices and still have little visibility of documents shared with advisers. For someone with substantial assets, a financial planner's file may sit alongside records held by an accountant, solicitor or mortgage broker. An assistant may help coordinate the correspondence. Financial statements and tax information can be accompanied by identity documents and emails about a property settlement or another substantial transaction. None of that implies those professionals are careless; it does mean the client's own account security covers only part of the arrangement.
It is reasonable to ask an adviser how identification documents should be supplied and whether access to the chosen document service is restricted to the people handling the work. A client can also ask who checks those arrangements, including any external IT provider's access. A useful answer should describe the process in ordinary language. It need not disclose technical details that would weaken security.
Storage and sharing need to be considered together. A restricted client portal offers limited reassurance if staff routinely download its documents into broadly shared folders. How long records remain available is also a fair subject for discussion, allowing for professional and legal retention requirements. Clients cannot audit all this themselves or obtain a guarantee, but they can reasonably expect the adviser to know who is responsible for checking it.
These proceedings concerned duties Fortnum had as an Australian financial services licensee. Under s 912A(1)(a) of the Corporations Act, it had to ensure services were provided efficiently, honestly and fairly. Sections 912A(1)(d) and (h) required adequate resources for services and supervision, and adequate risk management systems. The Court declared breaches of those duties, which also breached the civil penalty provision in s 912A(5A).
Sensible controls for an ordinary small business do not automatically carry the same AFSL duties. Privacy obligations require their own assessment: APP 11 concerns reasonable protection of personal information, while Privacy Act coverage has exemptions and exceptions. This judgment does not create a universal cybersecurity law for Australian businesses.
Understanding what is shared with external advisers is a useful part of private-client cybersecurity support, alongside protecting personal accounts and devices. A client can ask for an explanation of the practice's arrangements. The licensee is in a much stronger position to obtain evidence and require improvements, and the judgment shows why that work cannot stop at collecting attestations. A reported weakness needs follow-up until there is evidence it has been resolved, or an unresolved risk has been assessed and dealt with appropriately. Counting returned forms would leave the most consequential part of the oversight unfinished.
Tags: security, small-business, private-client, australia