Store Now, Decrypt Later: The Data Heist Waiting for a Quantum Key

By Atif SuhailReviewed by Louis CastelNov 11 2026

Somewhere, encrypted data is being copied and stored, waiting for a key that does not exist yet. Most data breaches end once the attacker can read the stolen files; this newer threat begins at that point. Security agencies call it “harvest now, decrypt later” (also “store now, decrypt later”): an adversary collects encrypted data today and holds it until future tools can unlock it.¹

Image Credit: Pingingz/Shutterstock.com

The attacker does not need to break encryption now. Intercepting encrypted network traffic, or stealing an encrypted archive, is enough. The ciphertext is simply kept. Storage is cheap, and patience costs little for a well-resourced intelligence service.¹

The payoff depends on a future machine. If a cryptographically relevant quantum computer is built, material protected by today's vulnerable public-key cryptography could become readable. No public source can say how much data has already been harvested this way. But governments, including the US and UK, treat it as an established threat model and a serious intelligence concern.¹

That is the unsettling reversal. The theft and the exposure are separated by years. A message sent safely in 2026 could be read in 2036, long after anyone remembers sending it.

Download a PDF of this article here

Which Secrets Will Still Matter in Ten Years?

The real risk depends on how long information stays useful, not only on when a quantum computer arrives. If data must stay confidential longer than it will take for quantum decryption to become possible, it is already exposed.²

The most attractive targets are long-lived:

• Government and diplomatic communications, which can shape policy and relationships for decades.
• Health and genomic records, which describe a person for life, and their relatives too.
• Intellectual property and research data, from drug formulas to chip designs.
• Critical infrastructure information, such as network layouts and control-system details.
• Financial and identity records, including the data used to verify who people are.

Short-lived information is different. A one-time password or a day's trading instructions may be worthless long before any quantum attack succeeds. Strategic secrets can stay sensitive for thirty years or more.²

Organizations should compare three numbers: how long they keep data, how long it must stay secret, and how long migration will take. If the last two together exceed the time left before a quantum attack is feasible, the data is at risk today.

Why Today's Public-Key Defenses Are Exposed

Public-key cryptography depends on math problems that are straightforward to compute in one direction and extremely difficult to reverse. RSA (Rivest–Shamir–Adleman) relies on the practical difficulty of factoring very large integers. Elliptic-curve cryptography and Diffie–Hellman key exchange rely on the discrete logarithm problem. For classical computers, solving these problems at the sizes used in modern systems would take impractically long.³

In 1994, Peter Shor showed that a large, error-corrected quantum computer could solve both problems efficiently. Such a machine running Shor's algorithm would undermine RSA, elliptic-curve schemes and Diffie-Hellman alike.

Symmetric encryption, such as AES (Advanced Encryption Standard), is affected differently. The best-known quantum attack, Grover’s algorithm, offers a far smaller speedup than quantum attacks on public-key schemes. AES with 256-bit keys, implemented well, is expected to remain viable.³

Most secure connections use public-key cryptography to agree on or protect the symmetric key that encrypts the actual data. Break the key exchange in a recorded session, and the symmetric key, and therefore the data, falls with it.³

The Quantum-Safe Toolbox Is Taking Shape

The main defense is post-quantum cryptography, or PQC. It is software-based cryptography built on maths problems believed to resist both classical and quantum attacks. It runs on ordinary computers and networks.³

In August 2024, the US National Institute of Standards and Technology (NIST) published its first three PQC standards:

Quantum resistance is about more than keeping data secret. Signatures prove who sent a message and that software has not been tampered with. Certificates, authentication and identity systems must all migrate too.²

PQC should not be confused with quantum key distribution (QKD). QKD uses quantum physics to share keys, but it needs specialised hardware and dedicated links. It is not a general replacement for internet cryptography.³

Organizations should rely on standardized algorithms and vetted implementations. Proprietary quantum-safe products with unclear foundations add risk rather than removing it.

Replacing an Algorithm Is the Easy Part

Migration is an infrastructure project, not a software patch. Before anything can be replaced, organizations must find where cryptography lives. It is often buried in:

• applications and APIs
• TLS connections
• certificates and public-key infrastructure
• hardware security modules
• firmware and connected devices
• backup and archival systems
• third-party platforms and supply chains

PQC keys and signatures are often much larger than their classical equivalents. That means more bandwidth, extra processing, and possible failures in protocols or devices built around small messages. Older hardware may lack the memory or power to cope, and some of it cannot be updated at all.⁴

Because no organization can switch everything at once, classical and post-quantum systems will have to coexist through a phased transition. This is where crypto-agility matters: the ability to swap one cryptographic algorithm for another without rebuilding the whole system.

Hybrid Security for an Uncertain Transition

Hybrid schemes combine an established classical algorithm with a post-quantum one, for example running elliptic-curve Diffie-Hellman and ML-KEM together to agree a key. The logic is simple: if the two are combined properly, the connection stays secure as long as at least one of them holds. That hedges against both a future quantum computer and an undiscovered flaw in the newer algorithms.⁴

Hybrid deployment lowers transition risk, but it adds complexity. It should follow published protocol guidance rather than improvised designs. It also needs testing under real operating conditions, not only laboratory benchmarks.⁴

What Organizations Can Do Before Q-Day

The work can start now, well before any quantum computer is ready:

1. Build a cryptographic inventory. Record where cryptography is used, and which algorithms, keys and certificates are involved.
2. Classify information by sensitivity, expected lifetime and value to a future adversary.
3. Prioritize long-lived secrets, especially communications that could be intercepted today.
4. Press vendors for documented PQC roadmaps, standards support and upgrade paths.
5. Pilot standardized PQC in controlled environments and measure its effect on performance and operations.
6. Strengthen the basics: key management, access controls and network monitoring.
7. Design for crypto-agility in new systems, rather than hard-coding a single algorithm.
8. Cover integrity as well as confidentiality, including signatures, authentication and software signing.

Official timelines give a sense of scale. The UK National Cyber Security Centre recommends completing discovery and initial planning by 2028, the highest-priority migrations by 2031, and full migration by 2035. NIST guidance likewise treats the protection of long-lived information as a reason to begin the transition before quantum computers can carry out the attack.⁴

The Deadline Is Set by the Data

No one can say for certain when a cryptographically relevant quantum computer will arrive. But every organization knows that some of its information must stay secret for years.

The most important date is therefore not Q-Day. It is the last day on which vulnerable encryption can safely protect data worth collecting. For the most sensitive records, that day may already have passed.

Quantum-resistant cryptography protects what is sent from now on. It cannot reach back and secure what has already been captured under weaker protection. Every year of delay adds to that future liability.

Wondering where quantum computing is up to? We explored the implications of Majorana 2 in this article

References and Further Readings

1. Baradziej, S., Harvest Now, Decrypt Later as a Cross-Sector Threat: A Scoping Review of Data-Confidentiality Lifetimes against Post-Quantum Migration Readiness. Int. J. Comput. Intell. Syst 2026.
2. Kuka, C.; Muhyaddin, S.; Teh, P. L.; Davies, L., Global Roadmaps for Post-Quantum Era in Finance: Policies, Timelines, and a Pragmatic Playbook for Migration. FinTech 2026, 5.
3. Campbell, R., Enterprise Migration to Post-Quantum Cryptography: Timeline Analysis and Strategic Frameworks. Computers 2025, 15, 9.
4. Barrett-danes, F.; Ahmad, F., Quantum Computing and Cybersecurity: A Rigorous Systematic Review of Emerging Threats, Post-Quantum Solutions, and Research Directions (2019–2024). Discover Applied Sciences 2025, 7, 1083.

Disclaimer: The views expressed here are those of the author expressed in their private capacity and do not necessarily represent the views of AZoM.com Limited T/A AZoNetwork the owner and operator of this website. This disclaimer forms part of the Terms and conditions of use of this website.