Financial advice group Fortnum Private Wealth has been fined $1.35 million over cybersecurity lapses including a data breach in 2022 that affected more than 9000 clients.

The company admitted failing to implement an adequate cybersecurity policy to mitigate risk for the business and its authorised representatives.

It also admitted lacking adequate cybersecurity expertise and risk management systems, exposing its ARs and their clients to serious harm and loss.

Fortnum agreed to the penalty, settling proceedings launched last year by the Australian Securities and Investments Commission.

Commission chair Sarah Court says the action shows financial services licensees need to “properly manage and protect” against digital threats.

“[The] outcome is the third obtained by ASIC against a licensee over failures to adequately protect against cybersecurity risk, following previous enforcement actions against RI Advice and FIIG Securities,” she said.

“In this case, Fortnum was aware of the cybersecurity risks facing its business and authorised representatives but failed to implement an adequate cybersecurity policy and have adequate oversight and monitoring arrangements.

“This outcome reinforces ASIC’s continued focus on licensees getting the fundamentals right. Strong cyber resilience is critical to maintaining trust and confidence in our financial system. We will continue to work with industry to lift standards and take action where businesses fall short.”

In the 2022 incident, a major breach at a Fortnum AR resulted in the removal and publication of more than 200 gigabytes of data that affected up to 9828 clients.

NSW Supreme Court’s Justice Ashley Black, who imposed the fine earlier this week, says the penalty provides the “necessary sting or burden, given the scale of Fortnum’s business, to achieve the objects of specific deterrence and general deterrence”.

He notes the “contravening conduct was not deliberate and that Fortnum has co-operated with ASIC, both during the investigation stage and in the conduct of this proceeding”.

Fortnum says new cybersecurity management frameworks, governance arrangements, controls and support are in place today.

CEO Matt Brown said: “As agreed with ASIC, over the last three years, Fortnum and the broader Entireti Group have made significant investments in cyber governance, oversight, specialist expertise, monitoring, training and support for adviser and risk management systems to strengthen cyber resilience across the business and adviser network, in an increasingly complex threat environment.”

See the ruling here.