The file your clients gave you

A family that engages a financial adviser hands over a good deal more than its goals: a passport or driver licence to prove identity, tax file numbers, bank and super account details, and usually a fairly complete picture of how the family's affairs are structured. Often that file sits with a practice of two or three advisers, on whatever systems that practice runs, and it can stay there long after the advice it supported was given.

In October the NSW Supreme Court ordered Fortnum Private Wealth to pay a $1.35 million penalty, plus $250,000 towards ASIC's costs, for failing to manage cybersecurity risk across its advice network. Fortnum is a licensee: it holds the financial services licence that independently run advice practices operate under. It admitted the failures, and the admitted facts show what a licensee did between writing a cyber policy and the day a practice in its network was breached.

What failed at Fortnum

Fortnum is a useful example because it did not ignore the problem. It introduced a cybersecurity policy in April 2021, covering its own business and a network that ran to between 81 and 94 practices, more than 200 advisers and around 55,000 retail clients.

The trouble was in what came after: the policy had been written in-house by a head of technology with no formal cybersecurity training, and no specialist was formally engaged to help. It asked practices to assess themselves but did not require them to fix what they found. By the first deadline in September 2021, fewer than half the practices had completed the self-assessment and about one in eight the attestation. The board and senior management were told more than once that completion was low, and nothing substantive changed until May 2023.

In that period ASIC listed at least five cyber incidents at practices in the network. Four involved email: an adviser's or a staff member's account taken over, or messages sent in an adviser's name. The fifth was the largest. Data relating to more than 9,000 clients was taken from one practice in September 2022. Fortnum learned of it in November 2022, and in March 2023 learned the data had been published on the dark web.

The court accepted that none of this was deliberate, that Fortnum cooperated, and that it was a small licensee that had made losses or minimal profits in most recent years. The penalty followed regardless. Fortnum admitted that it lacked an adequate policy, adequate oversight of its practices, people with the right expertise, and a risk management system that dealt with cyber in substance.

Where the obligation sits

Section 912A of the Corporations Act requires a licensee, among other things, to have adequate resources, including technological and human resources, and adequate risk management systems. It does not mention cyber, but Fortnum admitted that its failures breached it. The incidents happened at practices in the network rather than at the licensee itself. What Fortnum answered for was its own failure to have the resources and risk management systems to deal with cyber risk across the network it authorised.

For an adviser, that changes the conversation with the licensee. Fortnum has since introduced mandatory cyber controls, annual reviews, enhanced training and specialist cyber expertise. Expect other licensees to read the case the same way: the self-assessment comes back with consequences attached, and somebody checks the answers. Most of the evidence a licensee now needs has to come from the practices, because that is where the client data is.

Lawyers and accountants without a licence answer to their own professional rules rather than section 912A. Any business holding tax file numbers is covered by the notifiable data breaches scheme for that information, whatever its size, and since July the AML/CTF reforms have required many legal and accounting practices to verify and keep identity records for the services they cover. The file is much the same, and so are the emails asking someone to open an attachment.

What stays with the family

The obligation runs from the licensee to the regulator, and the penalty is paid to the Commonwealth. ASIC alleged no loss, and at the time Fortnum said no client financial loss had been detected. The practices in the network held identity documents, tax file numbers and account details. Once details like those are published, they do not expire when the case closes. They are what someone needs to impersonate a client convincingly, to a bank or to the client's own adviser, at any point in the years that follow.

When ASIC filed, Fortnum described the breached data as legacy records held by the practice. In most of the incidents I have worked on, the data that did the damage was data nobody needed any more: the scanned passport attached to an email from years ago, or the client export left in a shared folder after a platform migration.

What to do in the practice

Most of this is ordinary work, and little of it needs a large budget.

Find every place the file sits. The client platform is the obvious one. Then the email attachments, the downloads folder, the scanner's shared folder and the system you migrated off. Delete what you no longer need, once you have checked what you are required to keep and for how long.

Turn on multi-factor authentication for email and every client platform, including on the phone and the home laptop that open them. Four of the five incidents ASIC listed at Fortnum's practices involved email, and a stolen password is worth far less with this turned on.

Give cybersecurity a named owner with the right skills, inside the practice or engaged from outside. Not having people with that expertise was one of the four failures Fortnum admitted.

Answer the licensee's self-assessment as though it will be checked. Keep the evidence behind each answer.

Confirm any change to a client's payment details or instructions by calling a number you already hold. Never use one supplied in the message asking for the change.

Decide now what happens if a client's file is taken: who decides whether it must be reported, and who tells the family what it means for them.

The family's side

All of that protects the practice and the file it holds. It does not reach the family's side: their personal email, the devices at home, what is already known about them publicly, and what someone could do with a leaked passport and some patience. The adviser cannot reasonably own that, the licensee is not asked to, and an IT provider looks after devices rather than the people using them. Praetos starts with an assessment of the family: what is already known about each of them, how their personal email and devices are set up, and how someone could impersonate them. It then works alongside their adviser, lawyer and accountant, so that each knows what the others have covered.

Very few families ever ask their adviser where their passport copy is kept. A practice that has already found every copy, and deleted the ones it no longer needs to keep, has an easy answer if one ever does.

Craig Searle has spent 25 years in cybersecurity across banking, government, technology and critical infrastructure. He is a Founding Partner of Praetos, a private protective service for private clients and their families.