The corporate regulator has just handed down its second multi-million-dollar cybersecurity penalty against a financial services business in the space of eight months — and neither case involved exotic hacking. Both came down to basic controls that any business, not just a licensed financial firm, can check today.
On 12 October 2026, the Supreme Court of NSW ordered Fortnum Private Wealth Limited to pay a $1.35 million penalty after ASIC successfully argued the Australian financial services (AFS) licensee failed to maintain adequate cybersecurity policies, oversight and risk management across its network of authorised representatives. It’s the second such ASIC cybersecurity penalty in under a year, after the Federal Court fined FIIG Securities $2.5 million in February 2026 for a near-identical list of missing basics: no multi-factor authentication, no regular patching plan, no tested incident response plan.
What did ASIC just do to Fortnum Private Wealth?
ASIC’s own media release (26-244MR, published 14 October 2026) confirms the Supreme Court of NSW ordered Fortnum Private Wealth Limited to pay a $1.35 million penalty, plus $250,000 towards ASIC’s legal costs. Fortnum admitted that between 20 April 2021 and 11 May 2023 it did not implement an adequate cybersecurity policy across its business and authorised representative network, did not implement adequate processes and frameworks to oversee and monitor the cyber resilience of its authorised representatives, did not maintain adequate human resources with specialised cybersecurity expertise, and did not maintain adequate cybersecurity risk management systems.
Justice Black said the penalty needed to provide “the necessary sting or burden, given the scale of Fortnum’s business” to achieve both specific and general deterrence, while also noting Fortnum’s conduct was not deliberate and that it cooperated with ASIC throughout the investigation. ASIC Chair Sarah Court said Fortnum “was aware of the cybersecurity risks facing its business and authorised representatives,” and that the failures “exposed authorised representatives and their clients to the risk of cyber-related attacks.”
Why was FIIG Securities fined $2.5 million too?
FIIG Securities Limited was penalised $2.5 million by the Federal Court in February 2026 (plus $500,000 towards ASIC’s costs), after a 2023 breach exposed around 385GB of data from roughly 18,000 customers. What makes the FIIG judgment useful reading for any business, not just AFS licensees, is how specific the court was about which controls were missing. FIIG had no multi-factor authentication for remote user access, firewalls that weren’t configured with appropriate connectivity rules, no regular penetration testing of business-critical applications, no structured plan to patch known software vulnerabilities, and no cyber incident response plan tested at least annually. The judgment also noted weak password and privileged-account controls, no routine vulnerability scanning, and no mandatory staff cybersecurity training.
What do these two cases say about what regulators now expect?
Taken together, the Fortnum and FIIG judgments describe a working definition of “adequate” cybersecurity that goes beyond having a policy document on file. The controls both courts focused on are the same small set of basics that come up in almost every serious cyber incident Australian businesses deal with:
- Multi-factor authentication on every remote-access and email account, not just some.
- A structured patching plan for known software vulnerabilities, with a compensating control noted wherever patching isn’t immediately possible.
- Regular penetration testing of business-critical systems, at least annually.
- A cyber incident response plan that’s actually been tested, not just written and filed away.
- Properly configured firewalls and security software, reviewed rather than set once and left alone.
- Mandatory staff cybersecurity training, so the human side of the risk is covered as well as the technical side.
- A named person or team with real cybersecurity expertise accountable for the above, rather than it sitting informally with general IT staff.
Does this only apply to businesses with an AFS licence?
No. Both penalties were brought under ASIC’s specific powers over AFS licensees, so the legal mechanism doesn’t reach every business. What does reach every business is the standard the courts applied to decide what “adequate” cybersecurity actually looks like in practice — a standard that has nothing to do with being a financial licensee and everything to do with running basic, well-documented security controls. A legal practice, medical clinic, real estate agency or accounting firm holding client data faces the same practical risk Fortnum and FIIG were penalised for; it simply isn’t exposed to ASIC’s specific penalty powers in the same way. The OAIC, which does have broader reach across Australian businesses generally, has already signalled that the same kind of missing-basics case is exactly what its own enforcement priorities look for.
What should my business do now?
Treat the control list above as a genuine checklist rather than background reading. If your business can’t confirm, in plain terms, that MFA is switched on everywhere, that patching happens on a set schedule, that an incident response plan exists and has actually been tested, and that staff get real (not box-ticking) cybersecurity training, that’s the gap both of these judgments were about. None of these controls are exotic or expensive to put in place compared to the cost of a penalty, a breach, or both. Syntrex’s IT consulting team can review your current setup against this exact list and tell you plainly where the gaps are — call 1300 584 007 to arrange a review.
FAQs
How much was Fortnum Private Wealth fined? The Supreme Court of NSW ordered Fortnum Private Wealth Limited to pay a $1.35 million penalty on 12 October 2026, plus $250,000 towards ASIC’s legal costs, according to ASIC’s own media release.
How much was FIIG Securities fined, and when? The Federal Court ordered FIIG Securities Limited to pay a $2.5 million penalty in February 2026, plus $500,000 towards ASIC’s costs, following a 2023 data breach.
Does ASIC only penalise financial services businesses for weak cybersecurity? ASIC’s specific penalty powers in these two cases applied because both businesses held an Australian financial services licence, but the cybersecurity standard the courts applied — MFA, patching, tested incident response, penetration testing, staff training — is the same standard any business handling client data should be meeting.
What’s the single most common gap these cases point to? Missing or incomplete multi-factor authentication on remote access came up in the FIIG judgment specifically, and inadequate oversight and risk management came up in both — both are checked quickly and fixed without major cost.
Where can I read the ASIC findings myself? ASIC’s media releases 26-244MR (Fortnum) and its February 2026 release on the FIIG Federal Court judgment are both published on asic.gov.au and set out the admitted failures in full.