FIIG Securities fined $2.5m for cyber failures

FIIG Securities will pay $2.5 million over cybersecurity failures that went on for years and saw the private data of clients compromised and, in some cases, leaked.

- Jamie Williamson

ASIC brought its case against FIIG Securities in March 2025 after it found the firm failed to have adequate cyber risk management systems in place for about four years to June 2023.

As a result, between 19 May 2023 and 8 June 2023, a hacker was able to infiltrate FIIG's systems for about three weeks, stealing sensitive client information such as names, addresses, birth date, driver's licences, passports, bank accounts, and tax file numbers. The data was then released on the dark web.

The breach occurred after a FIIG employee downloaded a .zip file containing malware while browsing the internet and went undetected by FIIG, even after it received firewall email alerts flagging suspicious activity.