AFSLs urged to address cyber security vulnerabilities
With ASIC suing FIIG Securities for alleged failures in its cyber security measures, two firms have urged AFSLs to stay vigilant against ongoing cyber threats.
Earlier this month, ASIC announced that it was suing FIIG Securities for alleged failures in its cyber security measures, describing the matter as a “wake-up call” to all licensees.
The corporate regulator stated that FIIG Securities allegedly failed to have adequate cyber security measures for over four years, according to documents filed by ASIC in the Federal Court. This led to the theft of approximately 385GB of confidential data, ASIC alleged, with some 18,000 clients notified that their personal information might have been compromised.
The case marks the regulator’s second cyber security enforcement action, with the first being launched against RI Advice in 2022.
With licensee failures to have adequate cyber security protections sitting high on ASIC’s enforcement priorities for the year ahead, Hall & Wilcox has underscored what this means for the financial services industry.
“It is clear even at this early stage in the [FIIG Securities] proceeding that ASIC will be taking cyber security failings seriously in 2025. Enforcement action from ASIC could come as a direct consequence of a cyber breach if the licensee is considered to have failed to take steps to protect its systems from infiltration,” the law firm said.
Given the Australian financial services industry holds a “treasure trove” of sensitive client data, making it an attractive target for cyber crime, outsourcing solutions provider Vital Business Partner (VBP) also encouraged businesses to safeguard their operations and clients against cyber attacks.
“Risk awareness is the first step to strengthen your cyber defences. Cyber threats are constantly evolving, with attackers becoming more sophisticated in their methods,” VBP stated.
The most common and pressing types of attacks that financial services firms are at risk of include ransomware attacks, phishing attacks and supply chain vulnerabilities, it noted.
As such, VBP encouraged AFSLs to conduct a thorough risk assessment of the business, which means identifying its most valuable assets and the potential threats they face. Reviewing cyber security policies and procedures frequently while providing regular cyber security training to staff is also critical.
Moreover, licensees were recommended to implement multifactor authentication, which adds an extra layer of security to significantly reduce the risk of unauthorised access, and regularly update their systems to prevent attacks exploiting known vulnerabilities.
AUTHOR
Jasmine Siljic
Recommended for you
Digital advice tools are on the rise, but licensees will need to ensure they still meet adviser obligations or potentially risk a class action if clients lose money from a rogue algorithm.
Shaw and Partners has merged with Sydney wealth manager Kennedy Partners Wealth, while Ord Minnett has hired a private wealth adviser from Morgan Stanley.
Australian investors are more confident than their APAC peers in reaching their financial goals and are targeting annual gains of more than 10 per cent, according to Fidelity International.
Zenith Investment Partners has lost its head of portfolio solutions Steven Tang after 17 years with the firm, the latest in a series of senior exits from the research house.
