Australia's First $3M Cyber Penalty: What the FIIG Securities Case Means for Your Business

In February 2026, an Australian court handed down the country's first civil penalty for cybersecurity failures — $3 million total. The company wasn't hacked because of some sophisticated nation-state exploit. They were hacked because they didn't have the basics in place. Here's what happened, what the law actually says, and what every Australian business needs to do about it.​‌‌​​​​‌‍​‌‌‌​‌​‌‍​‌‌‌​​‌‌‍​‌‌‌​‌​​‍​‌‌‌​​‌​‍​‌‌​​​​‌‍​‌‌​‌‌​​‍​‌‌​‌​​‌‍​‌‌​​​​‌‍​​‌​‌‌​‌‍​‌‌​​‌‌​‍​‌‌​‌​​‌‍​‌‌‌​​‌​‍​‌‌‌​​‌‌‍​‌‌‌​‌​​‍​​‌​‌‌​‌‍​‌‌​​​‌‌‍​‌‌‌‌​​‌‍​‌‌​​​‌​‍​‌‌​​‌​‌‍​‌‌‌​​‌​‍​​‌​‌‌​‌‍​‌‌‌​​​​‍​‌‌​​‌​‌‍​‌‌​‌‌‌​‍​‌‌​​​​‌‍​‌‌​‌‌​​‍​‌‌‌​‌​​‍​‌‌‌‌​​‌‍​​‌​‌‌​‌‍​‌‌​​‌‌​‍​‌‌​‌​​‌‍​‌‌​‌​​‌‍​‌‌​​‌‌‌‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​​‌​‌‍​‌‌​​​‌‌‍​‌‌‌​‌​‌‍​‌‌‌​​‌​‍​‌‌​‌​​‌‍​‌‌‌​‌​​‍​‌‌​‌​​‌‍​‌‌​​‌​‌‍​‌‌‌​​‌‌‍​​‌​‌‌​‌‍​‌‌​​​​‌‍​‌‌‌​​‌‌‍​‌‌​‌​​‌‍​‌‌​​​‌‌‍​​‌​‌‌​‌‍​‌‌‌​‌‌‌‍​‌‌​‌​​​‍​‌‌​​​​‌‍​‌‌‌​‌​​‍​​‌​‌‌​‌‍​‌‌​‌​​‌‍​‌‌‌​‌​​‍​​‌​‌‌​‌‍​‌‌​‌‌​‌‍​‌‌​​‌​‌‍​‌‌​​​​‌‍​‌‌​‌‌‌​‍​‌‌‌​​‌‌‍​​‌​‌‌​‌‍​‌‌​​‌‌​‍​‌‌​‌‌‌‌‍​‌‌‌​​‌​‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​‌‌​‌‍​‌‌​​​‌​

---

---

What Actually Happened? The FIIG Securities Story Explained Simply

Imagine you're running a shop that holds your customers' most sensitive documents — their passports, bank accounts, tax file numbers. Now imagine you leave the back door propped open for four years. That's roughly what happened at FIIG Securities.

FIIG Securities is an Australian company that helps people invest in fixed-income products like bonds. They were managing around $3 billion in client assets at the time of the breach [2]. That's a lot of trust to carry. Their clients handed over some of the most sensitive data imaginable: tax file numbers, passport copies, bank account details, driver's licences.​‌‌​​​​‌‍​‌‌‌​‌​‌‍​‌‌‌​​‌‌‍​‌‌‌​‌​​‍​‌‌‌​​‌​‍​‌‌​​​​‌‍​‌‌​‌‌​​‍​‌‌​‌​​‌

‍​‌‌​​​​‌‍​​‌​‌‌​‌‍​‌‌​​‌‌​‍​‌‌​‌​​‌‍​‌‌‌​​‌​‍​‌‌‌​​‌‌‍​‌‌‌​‌​​‍​​‌​‌‌​‌‍​‌‌​​​‌‌‍​‌‌‌‌​​‌‍​‌‌​​​‌​‍​‌‌​​‌​‌‍​‌‌‌​​‌​‍​​‌​‌‌​‌‍​‌‌‌​​​​‍​‌‌​​‌​‌‍​‌‌​‌‌‌​‍​‌‌​​​​‌‍​‌‌​‌‌​​‍​‌‌‌​‌​​‍​‌‌‌‌​​‌‍​​‌​‌‌​‌‍​‌‌​​‌‌​‍​‌‌​‌​​‌‍​‌‌​‌​​‌‍​‌‌​​‌‌‌‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​​‌​‌‍​‌‌​​​‌‌‍​‌‌‌​‌​‌‍​‌‌‌​​‌​‍​‌‌​‌​​‌‍​‌‌‌​‌​​‍​‌‌​‌​​‌‍​‌‌​​‌​‌‍​‌‌‌​​‌‌‍​​‌​‌‌​‌‍​‌‌​​​​‌‍​‌‌‌​​‌‌‍​‌‌​‌​​‌‍​‌‌​​​‌‌‍​​‌​‌‌​‌‍​‌‌‌​‌‌‌‍​‌‌​‌​​​‍​‌‌​​​​‌‍​‌‌‌​‌​​‍​​‌​‌‌​‌‍​‌‌​‌​​‌‍​‌‌‌​‌​​‍​​‌​‌‌​‌‍​‌‌​‌‌​‌‍​‌‌​​‌​‌‍​‌‌​​​​‌‍​‌‌​‌‌‌​‍​‌‌‌​​‌‌‍​​‌​‌‌​‌‍​‌‌​​‌‌​‍​‌‌​‌‌‌‌‍​‌‌‌​​‌​‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​‌‌​‌‍​‌‌​​​‌​

Between 13 March 2019 and 8 June 2023 — over four years — FIIG's cybersecurity controls were inadequate for a business of their size and the sensitivity of the data they held [1]. The Australian Securities and Investments Commission (ASIC) alleged there was a "real and foreseeable risk" that FIIG would be targeted by a cyber-attack, given what they held. That risk materialized.

The attack itself began around 19 May 2023 when an employee downloaded a malicious .zip file — a classic phishing delivery method [3]. The ALPHV/BlackCat ransomware group, a sophisticated criminal gang, had found their way in. For weeks, the attackers moved through FIIG's systems undetected. Firewall alerts triggered. Nobody properly monitored them. FIIG didn't even know they'd been breached until the Australian Cyber Security Centre (ACSC) called them on 2 June 2023 [2]. By then, 385 gigabytes of confidential client data had been stolen and eventually leaked on the dark web.

On 9 February 2026, the Federal Court made orders by consent, and the judgment was published on 13 February 2026. The case citation is Australian Securities and Investments Commission v FIIG Securities Limited [2026] FCA 92 [2]. The penalty: $2.5 million in pecuniary penalties plus $500,000 in costs. Total impact: $3 million. Plus an independent expert review of their entire cybersecurity program. Plus reputational damage that contributed to them being acquired.

---

The Specific Failures: What FIIG Didn't Do (And You Might Not Either)

This is the section worth screenshotting and pinning above your desk. ASIC listed the specific failures that led to the penalty. Read these slowly, because they're painfully basic [1] [2]:

1. No Multi-Factor Authentication (MFA) for Remote Access

When employees or IT staff logged in remotely, they only needed a username and password. No second factor — no SMS code, no authenticator app, nothing.

Think of it like your online banking, but without the text message confirmation. A stolen password was all an attacker needed to get in. ALPHV/BlackCat exploited this.

Industry standard: The Australian Signals Directorate (ASD) lists MFA as one of the Essential Eight baseline controls — specifically, it's required for "remote access" and "all internet-facing services" [4].

2. Weak Passwords and Poor Access Controls for Privileged Accounts

The accounts with the most power — the ones that could access client databases and move through systems freely — weren't properly locked down. Weak passwords. Minimal controls.

In security terms, "privileged accounts" are the admin accounts, the system accounts, the ones that can do almost anything. If an attacker gets one of those, the game is largely over.

3. Misconfigured Firewalls and Security Software

FIIG had firewalls. They generated alerts. But the configuration wasn't right, and nobody was watching properly. The alerts essentially shouted into a void.

Security tools are only as good as their configuration and the people watching them. A misconfigured firewall is often worse than no firewall — it creates a false sense of security.

4. No Regular Penetration Testing or Vulnerability Scanning

FIIG didn't regularly test their own defences. Penetration testing is the practice of hiring ethical hackers to probe your systems for weaknesses — finding holes before the bad guys do.

Without regular vulnerability scanning, security debt accumulates invisibly. Old software, unpatched systems, forgotten credentials. FIIG's four-year window of inadequate controls didn't happen overnight. It was accumulated neglect.

5. No Structured Plan for Keeping Software Updated

Unpatched software is one of the most common attack vectors in the world. Every unpatched vulnerability is a known, published weakness that attackers can exploit.

FIIG didn't have a structured process to ensure their software was being updated to address security vulnerabilities [1]. This means they were running systems with known, fixable holes — for years.

According to ASD's Annual Cyber Threat Report 2022–23, patching applications and operating systems is one of the highest-impact security controls available to any organisation [5].

6. No Qualified IT Person Monitoring Threat Alerts

When your security software detected something suspicious, nobody adequately qualified was watching. The alerts came in. They weren't acted on. FIIG's own systems tried to warn them.

This is perhaps the most chilling failure. The attack was detectable. The signals were there. But the human layer — the qualified people who should have been reviewing them — simply wasn't in place.

7. No Mandatory Cybersecurity Training for Staff

The initial attack vector was an employee downloading a malicious file. That's a human layer failure — someone clicked something they shouldn't have. Mandatory cybersecurity awareness training exists precisely to reduce this risk.

FIIG didn't have it [1]. Untrained staff are an attacker's easiest target.

8. No Tested Incident Response Plan

FIIG didn't have an incident response plan that was tested at least annually [1]. When the attack happened, they didn't know what to do. They found out about the breach from ACSC — an external government agency — not from their own monitoring.

An incident response plan answers: "When (not if) something goes wrong, what do we do in the first hour? The first day? Who do we call?" Without rehearsal, even a good plan falls apart under pressure.

---

The Legal Framework: What Law Was Actually Broken?

This is important because the FIIG case wasn't decided under a special "cybersecurity law." It was decided under FIIG's Australian Financial Services (AFS) licence obligations — specifically Section 912A(1) of the Corporations Act 2001 (Cth) [6].

Section 912A requires AFS licensees to:

• Provide financial services efficiently, honestly and fairly [s.912A(1)(a)]
• Have adequate resources — financial, technological, and human — to provide services [s.912A(1)(d)]
• Have adequate risk management systems [s.912A(1)(h)]

ASIC argued — and the court agreed — that failing to implement basic cybersecurity controls breached all three. Cybersecurity isn't a separate IT concern; it's part of running your business lawfully.

Why this matters for businesses without an AFSL: The Corporations Act obligations are specific to AFS licensees, but the legal reasoning is not. Similar obligations exist in:

• The Privacy Act 1988 (Cth) — which applies to businesses with turnover >$3M and many smaller entities. The Australian Privacy Principles (APPs) require you to take "reasonable steps" to protect personal information from interference, misuse, and unauthorised access [7].
• The Security of Critical Infrastructure Act 2018 — for businesses in critical sectors including healthcare, education, communications, and energy.
• Industry-specific regulators — APRA for financial institutions (CPS 234), AHPRA for healthcare, TEQSA for education. All are watching cybersecurity closely following the FIIG judgment.

The FIIG case has drawn a line in the sand. "Reasonable steps" now has a technical floor — and that floor includes MFA, patch management, staff training, and tested incident response.

---

Why Australian SMBs Should Pay Attention (Not Just Financial Services)

Here's the honest message: most of the commentary on the FIIG case focuses on financial services. That's too narrow. This case matters to every Australian business that:

• Holds customer data (basically every business)
• Has employees who use email and the internet (same answer)
• Relies on digital systems to operate (you know the answer)

The Privacy Act is your FIIG equivalent. If you're a business that holds personal information — names, addresses, email addresses, purchase history, health information — you have legal obligations to protect it. The Office of the Australian Information Commissioner (OAIC) has been increasingly active in enforcement, and the FIIG ruling gives them an important precedent to point to.

In 2022, the Australian government announced proposed reforms to the Privacy Act that would significantly strengthen enforcement powers, including increased penalties up to $50 million for serious or repeated breaches [7]. Those reforms have been progressing through parliament.

The ACSC's own data shows that cybercrime reports in Australia increased by 23% in the 2022–23 financial year, with the average cost per report rising to $46,000 for small businesses, $97,200 for medium businesses, and $71,600 for large businesses [5]. These aren't statistics about someone else's problem. They're descriptions of what's already happening to Australian businesses right now.

The FIIG case closes the "it's just an IT issue" argument. When a court orders $3 million in penalties for cybersecurity failures under general business obligations — not a specialised cyber law — it signals that cyber hygiene is a boardroom responsibility. Every director, every owner, every manager now has reduced room to plead ignorance.

At lil.business, we work with Australian SMBs on exactly this problem: turning regulatory pressure into a practical action plan that doesn't require an enterprise security budget. The FIIG case is a gift, in a way — it gives us a concrete benchmark to work from.

---

The Self-Assessment Checklist: 12 Questions for Your Business Right Now

Run through this checklist honestly. These are the specific controls ASIC flagged, translated for businesses that aren't bond traders.

Access Controls

• 1. Do you have MFA enabled on all email accounts (Microsoft 365, Google Workspace)?
• 1. Do you have MFA on all remote access systems (VPN, remote desktop, cloud portals)?
• 1. Are your admin/privileged accounts separate from regular user accounts, with strong unique passwords?
• 1. Do you review who has access to what at least annually, and remove access for staff who leave?

Patching & Software

• 1. Do you have a process (even a simple monthly reminder) to install security updates on all devices and software?
• 1. Do you know what software is running on your systems? (You can't patch what you can't see.)

Monitoring & Detection

• 1. Do you have antivirus/endpoint protection on all devices, actively monitored?
• 1. Do you receive and review security alerts from your systems — and does someone qualified act on them?

People

• 1. Has every staff member received cybersecurity awareness training in the last 12 months?
• 1. Do you have a clear policy on what staff can and can't download or install?

Incident Response

• 1. Do you have a written incident response plan — even a one-pager — that answers "what do we do if we get hacked?"
• 1. Have you tested or reviewed that plan in the last year?

Scoring:

• 10–12 ticks: You're in reasonable shape. Get a proper audit to find the gaps you can't see.
• 6–9 ticks: You have meaningful exposure. Prioritise MFA and patching immediately.
• 0–5 ticks: You have material risk. This needs attention before a breach makes it urgent.

If you scored under 8, the lil.business cybersecurity consulting team can work through this with you and build a prioritised roadmap. Most SMBs can close their major gaps for far less than they expect — and dramatically less than $3 million → Book a free consultation.

---

What the Essential Eight Framework Tells Us

The ASD Essential Eight is Australia's government-endorsed baseline for cybersecurity. It's not a compliance checkbox — it's a practical list of eight controls that, together, stop the vast majority of cyber-attacks [4].

The eight strategies are:

1. Application control — only allow approved software to run
2. Patch applications — keep software updated promptly
3. Configure Microsoft Office macro settings — disable dangerous macro execution
4. User application hardening — configure browsers and applications securely
5. Restrict administrative privileges — limit who has admin access
6. Patch operating systems — keep OS updated
7. Multi-factor authentication — require MFA for remote access and sensitive systems
8. Regular backups — maintain and test backups

Every single failure ASIC cited in the FIIG case maps to an Essential Eight control [1] [4]. No MFA (control 7). No patching process (controls 2 and 6). No restricted admin access (control 5). If FIIG had implemented the Essential Eight at even Maturity Level One — the most basic level — the attack would likely have been detected sooner or stopped entirely.

The ASD provides free guidance on implementing the Essential Eight at cyber.gov.au [4]. It's designed for all Australian organisations, not just large enterprises. If you're not sure where to start with cybersecurity, start here.

---

What Happens After a Breach: The Real Cost Calculation

ASIC Deputy Chair Sarah Court's comment deserves to be quoted in full: "In this case, the consequences far exceeded what it would have cost FIIG to implement adequate controls in the first place." [1]

Let's put numbers to that. The controls FIIG failed to implement — MFA, patch management, staff training, monitoring, incident response planning — are not expensive. For a business of FIIG's size:

• MFA for all remote users: Included in most Microsoft 365 and Google Workspace plans. $0 incremental cost.
• Regular penetration testing: From approximately $3,000–$10,000 per year for a small organisation.
• Cybersecurity awareness training: Platforms like KnowBe4 or Proofpoint Security Awareness start from approximately $20–30 per user per year.
• Documented and tested incident response plan: A professional workshop to create one costs $2,000–$5,000.

Total estimated annual cost of adequate controls for a firm of FIIG's size: $20,000–$50,000 per year. Likely less for a typical SMB.

The FIIG outcome: $3 million in penalties and costs. Legal fees not yet accounted for. Reputational damage that contributed to an acquisition. ACSC involvement. Independent expert oversight mandated by the court. 18,000 clients whose data was posted on the dark web. The intangible costs dwarf the financial ones.

This is the value-based argument for cybersecurity investment: it is not a cost centre. It is risk management. And the FIIG case has just quantified what inadequate risk management costs in Australia.

---

Next Steps: What to Do This Week

The worst response to news like the FIIG case is paralysis. Here's a practical starting sequence:

This week (free, takes a few hours):

1. Enable MFA on your Google Workspace or Microsoft 365 account. Do it today. It's in Settings → Security → Two-step verification (Google) or Security → Multi-factor authentication (Microsoft). Done.
2. Check for pending software updates on all your business devices and install them.
3. Make sure you know who has admin access to your key systems. Review the list.

This month: 4. Send your team a 10-minute cybersecurity awareness reminder. The ACSC provides free resources at cyber.gov.au/protect-yourself/resources. 5. Write a one-page incident response plan. It only needs to answer: how do we know we're breached? Who do we call? What do we preserve? How do we notify clients?

This quarter: 6. Get a professional cyber risk assessment. If you're holding significant client data, this is not optional anymore. 7. Review your cyber insurance coverage against your actual risk profile.

The lil.business consulting team specialises in right-sized cybersecurity for Australian SMBs. We don't push enterprise solutions at small business budgets. We give you a practical, prioritised plan that matches your actual risk. Start with a free 30-minute consultation.

---

Related: What Is Multi-Factor Authentication and Why Does Every Australian Business Need It? — coming soon

Related: The Essential Eight Explained Simply: Australia's Cybersecurity Baseline for SMBs — coming soon

---

FAQ: FIIG Securities, ASIC Penalties, and Cybersecurity for Australian Businesses

References

[1] Australian Securities and Investments Commission, "26-021MR ASIC action sees FIIG Securities ordered to pay $2.5 million over cyber security failures," ASIC Media Releases, 13 Feb. 2026. [Online]. Available: https://www.asic.gov.au/about-asic/news-centre/find-a-media-release/2026-releases/26-021mr-asic-action-sees-fiig-securities-ordered-to-pay-2-5-million-over-cyber-security-failures/

[2] Federal Court of Australia, "Australian Securities and Investments Commission v FIIG Securities Limited [2026] FCA 92," Federal Court of Australia, 13 Feb. 2026. [Online]. Available: https://download.asic.gov.au/media/o02h30dd/26-021mr-asic-v-fiig-securities-limited-judgment-13-feb-2026.pdf

[3] Cyber News Centre, "11th February 2026 Cyber Update: FIIG Securities Fined $2.5M for Cybersecurity Failures," Cyber News Centre, 11 Feb. 2026. [Online]. Available: https://www.cybernewscentre.com/11th-february-2026-cyber-update-fiig-securities-fined-2-5m-for-cybersecurity-failures/

[4] Australian Signals Directorate, "Essential Eight," Cyber.gov.au, 2024. [Online]. Available: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight

[5] Australian Cyber Security Centre, "Annual Cyber Threat Report 2022–23," Australian Signals Directorate, 2023. [Online]. Available: https://www.cyber.gov.au/about-us/reports-and-statistics/asd-cyber-threat-report-july-2022-june-2023

[6] Commonwealth of Australia, "Corporations Act 2001 (Cth), s 912A — Obligations of financial services licensee," Federal Register of Legislation, 2001, as amended. [Online]. Available: https://www.legislation.gov.au/Details/C2021C00016/Html/Volume_4#_Toc62054792

[7] Office of the Australian Information Commissioner, "Australian Privacy Principles guidelines," OAIC, 2019, updated 2023. [Online]. Available: https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines

[8] Baker McKenzie / Global Compliance News, "Australia: Landmark Penalty for Cyber Security Failures," Global Compliance News, 20 Feb. 2026. [Online]. Available: https://www.globalcompliancenews.com/2026/02/20/https-www-bakermckenzie-com-en-insight-publications-2026-02-australia-landmark-penalty-for-cyber-security-failures_02202026/

[9] Herbert Smith Freehills Kramer, "First ASIC penalty for cybersecurity failures: Federal Court imposes $2.5m penalty on FIIG," HSF Kramer Insights, Feb. 2026. [Online]. Available: https://www.hsfkramer.com/insights/2026-02/first-asic-penalty-for-cybersecurity-failures-federal-court-imposes-two-point-five-million-penalty

[10] Corrs Chambers Westgarth, "Cybersecurity enforcement intensifies: lessons from FIIG Securities' $2.5m compliance penalty," Corrs Insights, Feb. 2026. [Online]. Available: https://www.corrs.com.au/insights/cybersecurity-enforcement-intensifies-lessons-from-fiig-securities-2-5m-compliance-penalty

[11] Australian Signals Directorate, "Essential Eight Maturity Model," Cyber.gov.au, Nov. 2023. [Online]. Available: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model

[12] Australasian Lawyer, "Federal Court hits FIIG Securities with $2.5m fine after data breach," The Lawyer Mag, 13 Feb. 2026. [Online]. Available: https://www.thelawyermag.com/au/practice-areas/corporate-and-ma/federal-court-hits-fiig-securities-with-25m-fine-after-data-breach/565583

---

Ready to close your gaps before a regulator does it for you? lil.business works with Australian SMBs to build practical, right-sized cybersecurity programs — no enterprise budget required. Book your free 30-minute consultation at consult.lil.business and get a straight-talking assessment of where you stand.

Related

• [[creative-research-2026-03-09]] — FIIG penalty research context and ASIC regulatory landscape
• [[creative-research-2026-03-09-w2]] — Deep dive on AU regulatory environment (SOCI Act, Smart Device Standards)
• [[vault/knowledge/compliance-research]] — ISO 27001, Essential Eight, DORA compliance research
• [[lilbusiness-essential-eight-2026-03-08]] — Essential Eight blog post; companion piece for FIIG penalty content
• [[vault/knowledge/competitor-intel]] — FIIG = underserved content opportunity in AU cyber consulting market
• [[lilbusiness-iso42001-compliance-2026-02-25]] — Related AU regulatory compliance content