Another win for ASIC on cybersecurity failures

Where did Fortnum fall short?

Fortnum's financial advice network comprised of over 80 advice practices and more than 200 authorised representatives. The practices collected and held sensitive information of over 50,000 retail clients, including identification documents, tax file numbers and financial account details. The Court found that Fortnum failed to implement an adequate cybersecurity policy or have adequate oversight or monitoring arrangements, which failures exposed their clients to the risks of cyber-attacks or cybercrime.

While Fortnum updated its cybersecurity systems and processes after ASIC took enforcement action, during the contravening period, Fortnum admitted to the following specific failures:

• a failure to maintain an adequate cybersecurity policy or risk management system. In particular, by neglecting to:

  • mandate mitigation strategies aligned with the Australian Cyber Security Centre's Essential Eight;

  • enforce completion of its self-assessment questionnaire, despite leadership knowing that only around 44% of authorised representatives had completed it (and only 12% had completed the accompanying 'attestation' of cybersecurity measures);

  • require practices to engage with Fortnum where their self-assessment revealed weaknesses;

  • require those practices to improve their processes in response; or

  • review the cybersecurity strategy of practices annually (as was required under its policy);

• have adequate processes, systems or frameworks to monitor practices' completion of the self-assessment and attestation; and

• have, or engage, resources with specialist cybersecurity qualifications, experience or expertise.

Lessons from ASIC enforcement action on cyber

The Fortnum judgment follows two other agreed (or not contested) enforcement outcomes obtained by ASIC for cybersecurity failures:

• ASIC v FIIG Securities Ltd [2026] FCA 92, where a penalty of $2.5 million was ordered, and

• ASIC v RI Advice Group Pty Ltd [2022] FCA 92, where no penalty was ordered although declarations were made as to contraventions.

These recent judgments on cybersecurity reinforce ASIC's expectation that cyber resilience is a core obligation for AFSL holders, and that deficiencies in cyber security controls can amount to contraventions of a AFSL holder's general obligations under s 912A, including:

• s 912A(1)(a) - the obligation to do all things necessary to ensure their financial services are provided efficiently, honestly and fairly;

• s 912A(1)(d) - the obligation to have adequate financial, technological and human resources to provide those services and carry out supervisory arrangements; and

• s 912A(1)(h) - the obligation to have adequate risk management systems.

While the penalties in ASIC's three enforcement actions to date have not resulted in penalties greater than $2.5 million, the penalty that a Court could order for contraventions of the above obligations could be significant depending on the extent of the failures and the size or financial position of the organisation (with the maximum penalty being the greater of $18.2 million or 10% of annual turnover).

ASIC's expectations for managing cyber risks

ASIC has stated that it will continue to take action "where businesses fall short" - that will particularly be the case where AFSL holders are aware of cybersecurity risks facing their business but fail to take adequate measures to address those risks.

ASIC issued an open letter in May 2026 to AFSL holders and market participants calling for urgent action on cyber resilience in the face of AI-accelerated threats.

ASIC's Annual Report for 2025-2026 also makes clear that cyber resilience remains a strategic priority for ASIC.

The takeaways for boards and executives are clear: a cybersecurity policy on paper is no longer enough. ASIC expects licensees to build their strategy on genuine expertise, enforce it and keep it under review – and it will act even where no client has suffered loss.

While what is "adequate" for the purposes of the general obligations under s 912A will be informed by the specific circumstances, AFSL holders should consider the following:

• implementing measures to adequately address known cybersecurity and cyber resilience risks faced by the business - those measures must be "demonstrably effective and proportionate to the nature, scale and complexity of a business";

• having a cybersecurity strategy that has been designed by those with expertise, and regularly reviewing that strategy having regard to the evolving threat environment; and

• ensuring senior leadership is actively overseeing cyber resilience risks and measures.