What happened
What: The Supreme Court of NSW ordered Fortnum Private Wealth Ltd to pay a $1.35 million penalty, plus $250,000 towards the costs of the corporate regulator, ASIC. Fortnum is a licensed financial advice business with a network of 81 to 94 advice practices, more than 200 advisers and around 55,000 retail clients. Between April 2021 and May 2023 it held client identification documents, tax file numbers and financial account details.
Fortnum admitted four things: it hadn't put in place an adequate cyber security policy for its business and its network of advisers; it hadn't set up adequate ways to oversee and monitor how well those advisers protected data; it didn't have enough staff with specialist cyber security expertise; and it didn't have an adequate system for managing cyber security risk. ASIC began the case in July 2025, after Fortnum told it about a cyber attack on one of its advisers. The judge noted that the conduct was not deliberate and that Fortnum cooperated with ASIC. ASIC's Chair said it was the regulator's third cyber outcome against a licence holder, after RI Advice and FIIG Securities.
Why it matters to your business: Fortnum was penalised under the rules for financial services licence holders, which don't apply to most small businesses, and the amount reflects a large firm. The lesson that travels is the shape of the failure: no written approach, no oversight of who handles the data, nobody responsible for security, and no routine for spotting risk. Those are the kinds of things a regulator can look at after an incident.
The rule that does apply to you
What: Under the Privacy Act, businesses it covers must take “reasonable steps” to protect the personal information they hold from misuse, interference, loss, and unauthorised access, change or disclosure. They must also destroy or de-identify that information when they no longer need it. This is Australian Privacy Principle 11, and the privacy regulator (the OAIC) publishes guidance on it.
“Reasonable” scales. The OAIC says it depends on things like your size and resources, how much personal information you hold, how sensitive it is, and how much harm a breach could cause. A sole trader with a contact form isn't expected to run what a 55,000-client network runs. But “I didn't think about it” is a weak position anywhere.
Does the Privacy Act cover you? Many businesses with annual turnover of $3 million or less are outside it. But the OAIC lists exceptions that apply whatever your turnover, including health service providers, businesses that trade in personal information, Commonwealth contractors, and businesses related to a larger covered company. Whether you're covered is a legal judgement, so it's worth having a professional review it.
Also relevant: if you are covered and personal information you hold is accessed or lost in a way that's likely to cause serious harm, you generally have to tell the OAIC and the people affected. That's the Notifiable Data Breaches scheme. Our guide on what to do when a supplier gets breached covers the supplier side of it.
The four gaps, as four small jobs
Here is each thing the Court heard Fortnum lacked, followed by the small-business-sized version. None of these are legal requirements spelled out for you. They're sensible ways to be able to show you took reasonable care.
A written approach to protecting customer data
What: One page that says what customer information you collect, where it lives, who can see it, and what you do if something goes wrong. Why it matters: It's the first thing anyone asks to see, and writing it forces you to notice the gaps. How to fix it: List every place customer details land (website forms, booking tool, email, spreadsheets, your accounting software). Note who has access to each. Add a short “if we think there's been a breach, we do this” list: who to call, how to change passwords, who to tell.
Knowing who can touch the data
What: Fortnum's gap was oversight of the advisers who handled client data. Yours is staff, contractors, your web developer and the software tools you use. Why it matters: Most small-business breaches start with a login someone shouldn't still have or a supplier nobody was watching. How to fix it: Review who has admin access to your website and email this week and remove anyone who has moved on. Turn on multi-factor authentication (a second proof like a phone code, on top of the password) for your email and website admin logins. Our 15-minute offboarding check walks through it.
Someone who owns security
What: Fortnum admitted it lacked staff with specialist cyber expertise. You probably won't hire a specialist, but you can name a person. Why it matters: Jobs nobody owns don't get done. How to fix it: Write down who is responsible (you, an office manager, or the agency that maintains your site) and what they do: apply software updates, check backups, review who has access. If it's an outside provider, ask them in writing what they cover and what they don't.
A simple routine for spotting risk
What: A “risk-management system” sounds corporate. For you it's a recurring 30-minute calendar entry. Why it matters: Risks change. A plugin you installed two years ago can become the weak point. How to fix it: Every quarter, check three things: is your website software and every plugin up to date, can your host actually restore a backup, and is there anything collecting customer data that you've stopped using (if so, delete it). The OAIC's guidance also calls out destroying or de-identifying information you no longer need.
The question isn't “could you have stopped every attack?” It's “can you show you took reasonable care before it happened?”
What AegorIQ can and can't see
A website review looks at your site from the outside, the way a visitor or an attacker would. It can check things like whether your site software and plugins have known vulnerabilities, whether your security settings and encryption are in place, whether your privacy policy actually covers what the law expects, which trackers are running, and, on the Deep Scan, whether your admin login is exposed to the open internet. You can see the full list in everything AegorIQ checks.
The honest part
A scan can't see your written security approach, who has access inside your accounts, whether anyone owns security in your business, or whether you review risk each quarter. Those four jobs above are yours to do. A review gives you the outside-in evidence; it does not replace them, and it is not legal advice or a finding that your business meets any legal standard. If you want to know where you stand under the Privacy Act, a privacy professional or lawyer is the right person to ask.
This week
- Remove admin access for anyone who no longer needs it, and turn on MFA for email and website logins.
- Write the one-page “where customer data lives and who can see it” list.
- Name who is responsible for updates and backups, and put a quarterly check in the calendar.
- Delete customer data you no longer need, including old exports and form submissions.
Sources
- ASIC media release 26-244MR, Fortnum Private Wealth penalised $1.35 million for cybersecurity failures, 14 October 2026 (penalty, costs, period, network size, admitted failures, judge's remarks).
- OAIC, APP 11: Security of personal information (reasonable steps; factors; destroy or de-identify).
- OAIC, Small business and the Privacy Act ($3 million turnover threshold and exceptions).
- OAIC, About the Notifiable Data Breaches scheme.