Australian Cyber Aware Regulation Enforcement Listing
Regulatory and enforcement actions often provide some of the clearest examples of where governance, cyber security, privacy, risk management, and compliance arrangements have failed. This register brings together enforcement activity from Australian regulators and governing bodies to help organisations stay informed, monitor regulatory trends, and learn from real-world cases. Each listing aims to provide practical insights to help boards, executives, and business owners strengthen their controls and reduce regulatory risk.
November 2026
04-Nov-26 AU
ACMA, Telcommunications, Spam Act 2003
SpinTel pays $653K penalty for spamming former customers
Australian telco SpinTel Pty Ltd (SpinTel) has paid a $653,400 penalty after sending more than 32,000 commercial emails without consent. An Australian Communications and Media Authority (ACMA) investigation found that between July and September 2025, SpinTel sent marketing emails to former customers encouraging them to return to the telco and promoted its products, including its NBN and mobile service plans.
October 2026
14-Oct-26 AU NSW
ASIC, Supreme Court of NSW, Finance, Corporations Act 2001 (Cth)
Fortnum Private Wealth penalised $1.35 million for cybersecurity failures
The Supreme Court of NSW has ordered Fortnum Private Wealth Ltd to pay a $1.35 million penalty after admitting it failed to adequately manage cybersecurity risks across its financial advice network.
ASIC Chair Sarah Court said the outcome reinforced that AFSL holders must properly manage and protect against cybersecurity risk. ‘Today’s outcome is the third obtained by ASIC against a licensee over failures to adequately protect against cybersecurity risk, following previous enforcement actions against RI Advice and FIIG Securities.
‘In this case, Fortnum was aware of the cybersecurity risks facing its business and authorised representatives but failed to implement an adequate cybersecurity policy and have adequate oversight and monitoring arrangements.”
September 2026
30-Sep-26 AU ACMA Telecommunications
Amaysim and Ezee Mobile breach anti-fraud rules
Amaysim Mobile Pty Ltd (Amaysim) has paid a $138,600 penalty after failing to carry out mandatory ID verification checks before transferring mobile phone numbers from other telco providers.
The Telecommunications (Mobile Number Pre-Porting Additional Identity Verification) Industry Standard 2020 requires telcos to use an additional ID verification process before transferring a mobile number to their service. They must also publish information for consumers about where to report suspected fraudulent number transfers.
03-Sep-26 AU ACMA Telecommunications
ACMA fines Telstra for SIM swapping prevention misses
Telstra has been fined $277,000 by the Australian Communications and Media Authority (ACMA) for not using required identity authentication processes to prevent SIM swapping fraud. In addition to the penalty, the ACMA has accepted court-enforceable undertakings from Telstra to strengthen its fraud prevention processes and improve training for customer-facing staff.
01-Sep-26 AU NSW
NSW District Court, Privacy Act
A Canva account at centre of legal fight over employee privacy
Australia’s new privacy laws have been used to prevent a business, The Art Scene, from destroying a former employee’s personal information, including family medical records, that were stored on a Canva account, in an unusual early application of the new rules.
