Buyer beware: Unprecedented legal decision over cybersecurity failures raises due diligence concerns

The landmark Federal Court ruling over a financial services firm's inadequate cybersecurity measures sounds major warning bells about cyber risk management strategy.

In an Australian first, financial planner RI Advice was last week found to have breached the law by failing to protect confidential client information from a spate of cyber attacks over a seven-year period.¹ RI Advice now faces hefty costs and serious reputational damage, the court ordering it to not only pay $750,000 to cover ASIC's legal costs but also engage cybersecurity experts to commandeer its risk management strategies and provide written progress reports to regulators at regular intervals.

Giving this case added weight is the fact RI Advice was purchased as part of a large transaction during the time of the cyber attacks. The court heard that nine incidents occurred at RI Advice when hackers infiltrated the servers of authorised RI Advice representatives between June 2014 and May 2020. On October