Fortnum Private Wealth cops $1.35m fine over cyber security failures

“Today’s outcome is the third obtained by ASIC against a licensee over failures to adequately protect against cyber security risk, following previous enforcement actions against RI Advice and FIIG Securities,” ASIC chair Sarah Court said in a 14 October statement.

“In this case, Fortnum was aware of the cyber security risks facing its business and authorised representatives but failed to implement an adequate cyber security policy and have adequate oversight and monitoring arrangements.

“These failures exposed authorised representatives and their clients to the risk of cyber-related attacks and cyber crime and fell below the standard the public is entitled to expect from an AFSL holder.

“This outcome reinforces ASIC’s continued focus on licensees getting the fundamentals right. Strong cyber resilience is critical to maintaining trust and confidence in our financial system. We will continue to work with industry to lift standards and take action where businesses fall short.”

Fortnum admitted to failing to implement an adequate cyber security policy across its network; to implement adequate processes, systems, and frameworks to oversee and monitor the cyber resilience of its representatives; to maintain adequate human resources with specialised cyber security expertise; and to maintain adequate cyber security risk management systems.

Justice Ashley Black said the company had agreed that its failures could have exposed clients to “... the risk of cyber-related attacks and cyber crime, the consequences of which could include serious harm and loss”.

VIEW ALL

“I am satisfied that the proposed pecuniary penalty in the total amount of $1.35 million will provide the necessary sting or burden, given the scale of Fortnum’s business, to achieve the objects of specific deterrence and general deterrence,” Justice Black said.

“That penalty properly reflects the matters agreed between the parties, including the fact that the contravening conduct was not deliberate and that Fortnum has cooperated with ASIC, both during the investigation stage and in the conduct of this proceeding.”

Fortnum’s chief executive, Matt Brown, said in a separate statement that despite the failures, “the Regulator did not identify any client or adviser loss caused by the contraventions, and our core systems were not compromised”.

“However, we apologise for the concern that this may have caused some of our clients. Our priority has always been and remains the safety of client assets and data and supporting advisers in maintaining robust safety standards,” Brown said.

“Cyber security is an ongoing challenge for all industries and organisations worldwide. Effective cyber resilience requires continuous improvement and shared responsibility across licensees, advisers, employees and technology providers.”