For years, cyber security sat in the IT budget. In 2026, Australian courts have made clear it is also a legal obligation for financial services licensees. In October, the Supreme Court of New South Wales ordered Fortnum Private Wealth Ltd to pay a $1.35 million penalty after it admitted failing to adequately manage cyber security risks across its financial advice network. It is the third outcome ASIC has obtained against a licensee over cyber failures, and the second penalty this year.

The Fortnum case

Fortnum ran a network of between 81 and 94 financial advice practices, with more than 200 authorised advisers and around 55,000 retail clients. Those practices held highly sensitive personal information, including identity documents, tax file numbers and bank account details.

Fortnum admitted that between 20 April 2021 and 11 May 2023 it failed to implement an adequate cyber security policy across its business and authorised representative network, failed to properly oversee and monitor its representatives’ cyber resilience, and lacked adequate specialist cyber expertise and risk management systems. ASIC began proceedings in July 2025 after Fortnum notified it of a cyber attack on one of its authorised representatives.

Justice Black accepted the agreed penalty, noting that the conduct was not deliberate and that Fortnum had co-operated with ASIC. Fortnum was also ordered to pay $250,000 towards ASIC’s costs, and ASIC says it has since strengthened its cyber security framework.

FIIG: the first Federal Court penalty

Fortnum follows a more serious case. On 13 February 2026, the Federal Court ordered fixed-income specialist FIIG Securities to pay $2.5 million in penalties and $500,000 towards ASIC’s costs, and to engage an independent expert to review its cyber controls.

FIIG admitted that between 13 March 2019 and 8 June 2023 it failed to have adequate cyber security measures. Its failures made a 2023 attack worse: around 385 gigabytes of confidential information were stolen, and client data, including driver’s licences, passports, bank details and tax file numbers, was leaked on the dark web. FIIG notified some 18,000 clients that their information may have been compromised.

The admitted gaps read like a basic cyber hygiene checklist: no multi-factor authentication for remote users, weak controls on privileged accounts, poorly configured firewalls, no regular penetration testing or vulnerability scanning, no structured patching plan, no qualified staff monitoring threat alerts, no mandatory staff training, and no incident response plan tested at least annually.

ASIC said it was the first time the Federal Court had imposed civil penalties for cyber security failures under the general obligations of Australian financial services licensees.

The legal theory

Neither case relied on a cyber-specific law. ASIC used the general obligations in section 912A of the Corporations Act: to provide financial services efficiently, honestly and fairly, to have adequate resources, and to maintain adequate risk management systems. That approach began with ASIC’s 2022 win against RI Advice, which established that inadequate cyber risk management can breach those duties.

The message is that cyber resilience is part of a licensee’s licence to operate. As ASIC put it in the FIIG case, the consequences “far exceeded what it would have cost FIIG to implement adequate controls in the first place”.

Why directors outside financial services should pay attention

The same logic is spreading. On 8 October 2025, Australian Clinical Labs became the first company ordered to pay civil penalties under the Privacy Act, a total of $5.8 million, over a data breach at its Medlab Pathology business. The Information Commissioner’s penalty cases against Medibank and Optus are continuing. ASIC has listed cyber attacks, data breaches and weak operational resilience among the key issues in its 2026 outlook.

For boards, the cases offer a ready-made list of questions. Is MFA enforced everywhere? Who monitors alerts out of hours? When was the incident response plan last tested? Are authorised representatives, franchisees or key suppliers held to the same standard? Directors who cannot get clear answers have a governance problem, not just a technology one.

Action points

  • Benchmark controls against the specific failures admitted by FIIG and Fortnum.
  • Extend oversight to networks such as authorised representatives and franchisees. Fortnum’s failure was largely one of supervision.
  • Fund cyber capability properly. Inadequate resourcing was itself a breach in both cases.
  • Test the incident response plan at least once a year and record the results.

This article is general information only and is not legal advice. Readers should seek advice specific to their circumstances.