ASIC Takes Former ANZ-owned RI Advice To Court Over Inadequate Cybersecurity

The Australian Securities and Investments Commission (ASIC) is alleging RI Advice Group Pty Ltd, an Australian Financial Services (AFS) licence holder focused on retirement advice, failed to have adequate cybersecurity systems in place.

ASIC has commenced proceedings in the Federal Court of Australia against RI, following a number of alleged cyber breach incidents at certain authorised representatives of RI.

According to ASIC, incidents included an alleged cyber breach at Frontier Financial Group Pty Ltd from December 2017 to May 2018.

Prior to October 2018, RI was a wholly-owned subsidiary of ANZ Bank. It then became a wholly-owned subsidiary of IOOF Holdings Limited as one of four financial planning dealer groups sold by ANZ under a AU$975 million deal.  

See also: Boards of Australian financial firms face tougher infosec rules from 1 July

ASIC alleges that Frontier was subject to a brute force attack whereby a malicious user successfully gained remote access to Frontier's server. ASIC alleges the actor spent more than 155 hours logged into the server, which contained sensitive client information including identification documents.

The financial watchdog alleges that RI, including its authorised representatives, failed to implement adequate policies, systems, and resources that are reasonably appropriate to manage risk in respect of cybersecurity and cyber resilience.

With the proceedings being launched on Friday, ASIC is seeking declarations that RI contravened certain provisions of the Corporations Act, orders that RI pay a civil penalty, and compliance orders for RI to implement systems that are "reasonably appropriate to adequately manage risk in respect of cybersecurity and cyber resilience and provide a report from a suitably qualified independent expert confirming that such systems have been implemented".

A report from ASIC in December found that while awareness and management of cybersecurity risk were improving in Australia's financial market, there was still room for improvement across the entire sector.

"Organisations are alert to cybersecurity threats to their business and have focused their resources and efforts on improving their cybersecurity governance, risk management, and response and recovery capabilities," the watchdog wrote.

MORE FROM ASIC

• ASIC says cybersecurity risk management is improving in Aussie financial market
• ASIC wants to see more adoption of regtech by Australia's financial sector
• ASIC seeks externally managed data analytics service for financial stats
• ASIC to form chief data office for data strategy rollout
• ASIC to conduct natural language processing trials
• ASIC gets serious about ICO crackdown