FIIG Securities Fined $2.5M for Cybersecurity Failures Leading to Client Data Breach Australia’s financial regulator, ASIC, has secured its first penalty of this kind, ordering fixed income specialist FIIG Securities to pay $2.5 million for cybersecurity failures that resulted in a breach exposing the personal data of 18,000 clients. The incident marks a significant enforcement action under Australia’s financial services laws, underscoring regulatory scrutiny on cybersecurity compliance in the sector. The breach stemmed from inadequate security measures, though specific details of the attack including the timeline and methods used remain undisclosed. The penalty reflects ASIC’s growing emphasis on holding firms accountable for safeguarding client information, particularly in industries handling sensitive financial data. The case sets a precedent for future enforcement, signaling that cybersecurity lapses may carry substantial financial consequences for financial services providers. No further details on remediation efforts or client notifications were provided.

FIIG Securities Fined AU$2.5M for Prolonged Cybersecurity Failures Leading to Major Data Breach Australian fixed-income firm FIIG Securities has been fined AU$2.5 million by the Federal Court after failing to protect client data from cyber threats over a four-year period, culminating in a 2023 ransomware attack that exposed sensitive personal and financial information. The penalty marks the first time the court has imposed civil penalties for cybersecurity failures under an Australian Financial Services (AFS) license. The breach, attributed to the ALPHV/BlackCat ransomware group, occurred in May 2023 when a hacker infiltrated FIIG’s network and remained undetected for nearly three weeks, exfiltrating 385GB of data. Compromised information included names, addresses, driver’s licenses, passports, bank details, and tax file numbers belonging to 18,000 clients. FIIG only learned of the incident after being alerted by the Australian Signals Directorate’s Cyber Security Centre (ASD’s ACSC) on June 2, delaying its internal investigation by six days. The court found that FIIG had failed to implement basic cybersecurity measures between March 2019 and June 2023, including: - Poorly configured firewalls and irregular software patching - Lack of mandatory cybersecurity training for staff - Inadequate privileged access management and multi-factor authentication (MFA) - No up-to-date incident response plan or regular vulnerability scanning - Ineffective endpoint detection and response (EDR) tools - A poorly configured Security Information and Event Management (SIEM) system FIIG admitted to violating its AFS license obligations, acknowledging that stronger controls could have prevented or mitigated the breach. In addition to the fine, the firm was ordered to pay AU$500,000 toward ASIC’s enforcement costs and must now implement a compliance program overseen by an independent cybersecurity expert. ASIC Deputy Chair Sarah Court emphasized the case as a warning, stating that “inadequate controls put clients and companies at real risk”, while ASIC Chair Joe Longo stressed that cybersecurity requires continuous monitoring, not a “set and forget” approach. The ALPHV/BlackCat group, known for using compromised credentials, PowerShell scripts, and Cobalt Strike to disable security features, later claimed responsibility for the attack. The breach was discovered only after an employee was locked out of their email, revealing encrypted files and wiped backups. While FIIG restored some systems, critical data was permanently lost. The case sets a precedent for cybersecurity enforcement in Australia’s financial sector, with experts noting that regulators now expect firms to align protections with data sensitivity, business scale, and potential attack impact.

FIIG Securities, an Australian financial services firm, faces legal action after a cybersecurity breach resulted in the unauthorized access and exposure of sensitive information belonging to 18,000 clients. From March 2019 to June 2023, FIIG reportedly had inadequate cybersecurity defenses, which led to a hacker penetrating their IT network and extracting about 385GB of confidential data, including client details, over a period from May 19 to June 8, 2023. The leaked information was later discovered on the dark web, posing significant risks to the affected clients.