ASIC Fined a Licensee $1.35 Million for the System It Didn’t Have

Fortnum Private Wealth did not ignore cyber security. In April 2021 it issued a cyber security policy to its network. It asked every practice to complete a self-assessment and sign an attestation. Its risk register named the policy as the control for hacking and privacy breaches.

On 12 October 2026 the NSW Supreme Court ordered it to pay a $1.35 million penalty anyway.

Short answer

ASIC’s case against Fortnum was not about the breach at one of its practices. It was about the system around it. Fortnum admitted it had no adequate cyber policy across its network, no real oversight of its advisers’ cyber resilience, no one with cyber security expertise, and a risk management system that relied on a policy that could not do the job. The court ordered a $1.35 million penalty plus $250,000 of ASIC’s costs. Each of those four gaps maps to something ISO 27001 already requires.

What the court ordered

In ASIC v Fortnum Private Wealth Ltd [2026] NSWSC 1252, Black J made declarations and ordered the penalty the parties had agreed. ASIC announced the outcome on 14 October.

Between 20 April 2021 and 11 May 2023, Fortnum was the licensee for between 81 and 94 financial advice practices, more than 200 advisers and around 55,000 retail clients. The practices held identity documents, tax file numbers and bank account details. Fortnum admitted contravening its licence obligations to provide services efficiently, honestly and fairly, to have adequate resources, and to have adequate risk management systems (sections 912A(1)(a), (d) and (h) of the Corporations Act).

The court accepted that the conduct was not deliberate, and that Fortnum cooperated with ASIC throughout.

What happened at the practice

The agreed facts describe two incidents at Fortnum’s practices in 2022.

In the first, staff at one practice clicked phishing links. An attacker got into at least one email account and sent 1,266 phishing emails from it. Fortnum knew by 30 August 2022.

The second was larger. Between 5 and 20 September 2022, another practice, Wealthwise, had more than 200 gigabytes of data exfiltrated and published, relating to up to 9,828 clients. Most of them had been clients before Wealthwise joined Fortnum. Fortnum learned of the breach around 18 November and was told on 9 December that there was no evidence of client data loss. Then, around 2 March 2023, it learned that a significant amount of the data was on the dark web. It reported to ASIC on 30 March.

In between, Optus and Medibank had their breaches. The judgment notes that both were widely publicised.

Why the policy did not count

This is the part every licensee, franchisor and network operator should read twice. Fortnum had the paperwork. The court found it did not have the system.

• The policy did not require anything to change. Practices answered a self-assessment with “yes”, “no” or “unsure”. The policy did not make them fix the “no” answers, and did not make them talk to Fortnum about them. The ACSC Essential Eight mitigations sat in an optional “advanced” tier.
• Nobody checked. Fortnum had no process to monitor whether practices completed the self-assessment, what they did about their “no” answers, whether they followed the policy, or which IT providers they used.
• Nobody qualified was running it. Fortnum had 22 to 32 staff during the period, and none had specialist cyber security qualifications or experience. It did not formally engage anyone who did.
• The risk register pointed at the policy. From August 2021, the register listed compliance with the policy as the control for hacking and privacy risks. The control on paper was a policy that, by Fortnum’s own admission, was not adequate.

The four failures as four ISO 27001 requirements

None of this is exotic. It is the core of what a certification auditor tests. A self-assessment questionnaire that nobody follows up is exactly what an internal audit is designed to find.

Three cases, one direction

ASIC’s release names the two earlier cases, and together they show where enforcement is heading:

• RI Advice (2022). The Federal Court found the licensee had breached its obligations by failing to manage cyber risk across its authorised representatives. No penalty was ordered, but it had to engage a cyber security expert to fix its network (22-104MR).
• FIIG Securities (February 2026). The first court-ordered penalty for cyber security failures: $2.5 million (26-021MR).
• Fortnum (October 2026). $1.35 million, for a licensee whose breach happened at a practice it was meant to oversee.

The first case set the duty. The second attached a price to it. The third applies it to a network model.

If you run a network

The same exposure sits with any business that is accountable for what happens at sites it does not run day to day: AFS licensees with authorised representatives, franchise groups, buying groups, and managed service providers looking after client environments. Our article on supplier breaches covers the other side of the same problem.

Three questions to answer honestly:

1. When a member answers “no” to a security question, what happens next, and who checks that it happened?
2. Does anyone in head office have the competence to judge whether a member’s answer is good enough?
3. Does your risk register name a control that would actually stop the risk, or a document that says it should be stopped?

What to check this month

• Re-read your security policy as an auditor would. Does it require anything, or does it only recommend?
• Pull the last self-assessment or attestation round. Count the “no” and “unsure” answers, then count how many have a recorded fix.
• Check your risk register. For each cyber risk, is the named control something that operates, or something that is written down? The same question an insurer will ask.
• Name the competent person. If it is nobody, decide whether you hire, engage or develop that capability.
• Book an independent look. A gap analysis before ASIC or a customer asks is cheaper than one after.

ASIC cyber penalty: FAQs

What did Fortnum Private Wealth do wrong?

It admitted that between April 2021 and May 2023 it did not have an adequate cyber security policy across its network, adequate oversight of its authorised representatives’ cyber resilience, adequate specialist cyber security staff, or an adequate cyber risk management system.

Was Fortnum penalised for the data breach?

Not directly. The contraventions were failures of its licence obligations to have adequate policies, resources, oversight and risk management. A breach at one of its practices led ASIC to investigate.

Do AFS licensees have a specific cyber security law?

There is no single cyber statute for licensees. The obligations come from the general licence duties in section 912A of the Corporations Act, which the courts have now applied to cyber security in three cases.

Does ISO 27001 certification satisfy ASIC?

Certification is not a legal safe harbour. But the four things Fortnum lacked (a policy with teeth, oversight, competent people and a working risk process) are exactly what an ISO 27001 system requires and an accredited auditor tests.

We are not a financial services business. Does this apply to us?

The licence duties don’t, but the lesson does. Any organisation that relies on a network of practices, franchisees, members or suppliers to protect data on its behalf carries the same oversight problem.

How Streamline can help

Streamline builds and audits ISO 27001 information security management systems for Australian organisations, including businesses that oversee networks of practices and representatives. You deal directly with an experienced ISO Lead Auditor. A gap analysis shows where your policy, oversight and risk register would stand up, and where they would not. ISO mentoring helps your own people build the system. If you would like a hand, get in touch.

General information only, not legal advice. Facts are drawn from the agreed facts in the judgment and ASIC’s media releases.

Sources

• NSW Caselaw: ASIC v Fortnum Private Wealth Ltd [2026] NSWSC 1252
• ASIC media release 26-244MR: Fortnum Private Wealth penalised $1.35 million
• ASIC media release 22-104MR: RI Advice
• ASIC media release 26-021MR: FIIG Securities

Published 15 October 2026 | Facts checked 16 October 2026 | Next review April 2027 | Jurisdiction: Commonwealth (Corporations Act 2001) | Edition: ISO/IEC 27001:2022