Fortnum Private Wealth pays $1.35m to resolve cyber case

Fortnum Private Wealth, which is owned by Entireti, has agreed to pay $1.35 million to the Australian Securities and Investments Commission as a result of the lawsuit brought by the regulator against Fortnum in July 2025 for the alleged failure to properly manage and mitigate cybersecurity risks.

Fortnum chief executive Matt Brown said in a statement the company reached an agreement to resolve legal proceedings in relation to a historic cyber governance matter, which occurred between April 2021 and May 2023.

“Fortnum self-reported the matter to ASIC and cooperated with them to resolve the matter, avoiding a lengthy trial and has agreed to pay a penalty of $1.35 million and ASIC’s costs,” Brown said.

The decision was made in the NSW Supreme Court on 12 October.

The $1.35 million reflects the circumstances and facts including that Fortnum made a loss in 2023 and 2024 and a “modest” profit in 2025. ASIC also said that Fortnum has made improvements to its systems since the contraventions and has cooperated with ASIC avoiding the need for a contested trial.

Brown said the regulator did not identify any client or adviser loss caused by the contraventions, and Fortnum’s core systems were not compromised.

“However, we apologise for the concern that this may have caused some of our clients. Our priority has always been and remains the safety of client assets and data and supporting advisers in maintaining robust safety standards,” Brown said.

He added the cyber security frameworks and policies reviewed by ASIC three years ago no longer reflect the cyber security management framework, governance arrangements, controls and support that are currently in place today in the business.

“As agreed with ASIC, over the last three years, Fortnum and the broader Entireti Group have made significant investments in cyber governance, oversight, specialist expertise,monitoring, training and support for adviser and risk management systems to strengthen cyber resilience across the business and adviser network, in an increasingly complex threat environment.

“Cyber security is an ongoing challenge for all industries and organisations world-wide. Effective cyber resilience requires continuous improvement and shared responsibility across licensees, advisers, employees and technology providers.”

Fortnum also has appointed a dedicated head of cyber security, Brown tells Professional Planner, cyber security is fully integrated into risk management across the business.

“We have had a dedicated head of cyber security for a number of years to oversee our policy settings, operations, training and education, and provide practical support for our team and advisers.

“Our team of IT professionals is the appropriate size for our organisation. They are focused on cyber security, and more broadly on how best to use emerging technology to support advisers to be more productive and efficient, and deliver an enhanced client experience,” Brown says.

In February, the Federal Court ordered fixed-income specialist FIIG Securities to pay a $2.5 million penalty and $500,000 towards ASIC’s costs after the regulator sued FIIG for allegedly failing to protect thousands of clients from cyber security threats for more than four years.

This was exacerbated after a 2023 cyber-attack which saw around 385 gigabytes of confidential information stolen and highly sensitive client data leaked onto the dark web.

In May 2022, RI Advice was ordered to pay $750,000 towards ASIC’s costs following proceedings in the Federal Court that found the AFSL breached its license obligations to act efficiently and fairly when it failed to have adequate risk management systems to manage its cybersecurity risks.