Fortnum Private Wealth will pay a $1.35 million penalty after admitting to inadequate management of cybersecurity risks within its network, following legal action brought by the corporate regulator. The case was heard in the New South Wales Supreme Court, where the regulator alleged that the firm’s insufficient cybersecurity measures exposed clients and authorised representatives to significant risks.

The failure to maintain robust cybersecurity controls led to multiple cyber incidents, including an attack that resulted in the personal data of over 9,000 clients being published on the dark web. The regulator argued that these breaches demonstrated a failure to comply with the firm’s obligations under its Australian Financial Services Licence.

Justice Ashley Black imposed the penalty, noting that it was intended to serve both specific and general deterrence, reflecting the size and scope of Fortnum Private Wealth’s operations. The judge emphasized the need for a punitive measure that would dissuade similar lapses within the industry.

Sarah Court, chair of the corporate regulator, said the outcome underscores the importance of license holders actively managing cybersecurity risks to protect clients’ data and maintain confidence in the financial services sector. She highlighted that firms must take comprehensive steps to prevent, detect, and respond to cyber threats to fulfill their regulatory responsibilities.

The ruling marks a significant enforcement action, signaling heightened regulatory scrutiny on cybersecurity practices among financial advisory firms in Australia. Fortnum Private Wealth did not publicly respond to the penalty at the time of the ruling.