Hackers can steal data they can't read yet. Quantum could open it later.

Most of the web is protected by encryption that no computer today can break. Anyone who copies the traffic gets scrambled noise. A future quantum computer could change that. The US Government Accountability Office (GAO) says plainly that today's quantum computers cannot yet break this cryptography, and that most industry experts expect a machine that can, possibly as soon as the 2030s, though estimates vary widely.

Here is the catch. Encrypted data does not expire. If someone copies it now and stores it, they can try to open it later. NIST, the US standards body, describes this as adversaries collecting encrypted data now with the goal of decrypting it once quantum technology matures. That is harvest now, decrypt later.

Think of a Berlin online shop with a three-year supply contract, or a dental clinic in Ohio with patient records. Neither loses anything on the day the data is copied. The loss, if it comes, arrives years later, when the stored copy finally opens.

An attacker does not need to break in anywhere. GAO lists three ways someone could grab data in transit now and keep it, with a real-world precedent for each:

• Rerouting traffic. Internet routing relies on a protocol called BGP that can be abused to send traffic through a device the attacker controls. GAO notes that in June 2024 the US Federal Communications Commission highlighted a Defense and Justice Department report that a Chinese telecommunications company misrouted US internet traffic at least six times using BGP weaknesses.
• Compromised equipment. Network devices with hidden functionality can copy traffic to a separate store.
• Tapping the line. Physical access to cables, or nearby radio equipment, can capture wired and wireless traffic.

Europol adds that the standard tools protecting the internet today, TLS, SSH and OpenPGP, are all open to this threat in principle, with the level of risk depending on how they are set up.

Why it is harder than it sounds

GAO also lists reasons a harvest would not be easy, and they are worth knowing so you can keep the threat in proportion:

• One key at a time. Breaking a single key with a future quantum computer could take from several hours to more than 200 hours, depending on the algorithm. Many systems also rotate keys often.
• Guesswork. Because everything on the internet is encrypted, an attacker must guess which stolen data will still be valuable later.
• Cost. A 2023 RAND estimate put the energy for one key at about 1 gigawatt of electricity and about $64,000. NIST officials told GAO that theoretical proposals could cut that by a factor of 10.

The conclusion GAO draws is not "relax". If an attacker harvests enough data, some of it will be valuable, and a well-resourced attacker could afford the cost. Which brings us to the question that matters for you: which data would you hate to see opened in 2036?

Europol rates the risk by who you are. Private individuals sit at low to medium, because most personal data loses value. Small and large companies sit at medium to high, because trade secrets, client lists, financial data and sensitive contracts keep their value for years. Governments sit at high.

US federal rules use a simple test you can copy. The guidance GAO cites asks agencies to find systems holding data that would still be sensitive if a quantum computer decrypted it in 2035. Ask the same question about your own records:

• Long-lived, high valueContracts and pricing, source code, product designs, M&A files, legal and financial records, health and identity data. Protect these first.
• Useful for a few yearsCustomer lists, internal strategy, HR records. Medium priority.
• Worthless quicklyDelivery updates, session data, marketing analytics. Low priority.

NIST's draft transition report adds a rule of thumb it calls Mosca's theorem. Say your data must stay secret for X years, and your move to new cryptography will take Y years. If X plus Y is longer than the time Z until a capable quantum computer exists, you are late. NIST notes that past cryptographic migrations have taken more than a decade, and that going from a new standard to full use has historically taken 10 to 20 years.

Nobody knows where the red line sits. In a December 2024 survey by the Global Risk Institute, most of 32 quantum experts said there is better than a 50% chance of such a computer by 2040, while a small minority thought it could come much sooner. GAO adds that some experts predict it within 10 to 20 years. That is a wide range, which is exactly why the planning, not the date, is what you control.

On 6 October 2026 GAO published a public version of an audit it first issued in sensitive form in September 2025, and reissued it with revisions on 14 October. It checked the 24 largest US federal agencies against three preparation steps: inventory the systems that use vulnerable cryptography, work out the funding to replace them, and test the new algorithms in your own environment.

The results are a useful mirror for any organization:

• None of the 24 agencies fully completed all three steps.
• Only one fully completed its inventory of priority systems and the vulnerable algorithms they use. One agency had no inventory, and the other 22 had partial ones.
• None fully identified the funding. Agencies said they lacked reliable price quotes and tools, and that products with post-quantum support were scarce.
• None had performed tests of the new algorithms.

GAO traces the gaps to a shortage of cryptography expertise, no documented processes for building inventories, and no plans for testing. In the sensitive version of the report it made 89 recommendations to 23 agencies. Twelve agencies agreed with them, two partly agreed, seven neither agreed nor disagreed, and one disagreed with three of its four recommendations.

The lesson is not that the government is uniquely behind. It is that the first step is the hard one. Most organizations cannot say where they use public-key cryptography, who owns it, or when it expires. You cannot protect what you have not listed.

Where things stand

1. August 2024NIST finalizes its first three post-quantum standards (FIPS 203, 204 and 205).
2. November 2024NIST publishes a draft transition plan (IR 8547). It proposes deprecating RSA and elliptic-curve signatures at the 112-bit level after 2030 and disallowing them after 2035. We could not find a final version.
3. October 2025Cloudflare reports that the majority of human-initiated traffic on its network uses post-quantum encryption.
4. October 2026GAO and Europol both publish reports on the threat.

You do not need a quantum budget to begin. Most of this is hygiene, and a good part of it is already switching itself on in the software you use.

• 1. Remove the weakest setupsEuropol's advice for medium-risk organizations is to upgrade to TLS 1.3 and SSH2, disable legacy protocols and enforce forward secrecy. In older TLS 1.2 setups that do not use forward secrecy, stealing the server's private key is enough to decrypt past recorded sessions.
• 2. Delete what you do not needEuropol also recommends data minimization. Data you no longer hold cannot be harvested later. Set retention periods for backups, exports and old shared drives.
• 3. Make a cryptography inventoryList where you use public-key cryptography: websites and certificates, VPNs, SSH keys, code signing, email encryption, payment links, device firmware. Note the owner and the expiry of each. This is the exact step GAO found most agencies had not completed.
• 4. Rank by shelf lifeMark each system with how long its data must stay secret (X). Anything that needs to stay secret beyond 2035 goes to the top of the list.
• 5. Ask your vendorsPut one question in every security review and renewal: "What is your roadmap for post-quantum cryptography, and by when?" GAO found vendor immaturity was a main reason agencies could not price the move, so your questions help set the pace.
• 6. Turn on hybrid key exchangeCloudflare reports that the hybrid method X25519MLKEM768, which pairs a classic algorithm with the new ML-KEM standard, is ready to use and widely deployed. Check that your web servers, CDN and VPN support it, and enable it where offered.
• 7. Use AES-256 where it is easySymmetric encryption is weakened by quantum computers, not broken. Europol notes experts recommend precautionary measures such as moving from AES-128 to AES-256 where possible.
• 8. Build crypto-agilityAvoid hard-coding algorithms. If you can swap an algorithm through configuration rather than a rewrite, every future migration gets cheaper.

If you only do two things this quarter, make them steps 3 and 5: know where your cryptography is, and ask your vendors what they plan to do. Both cost little and both feed every other step. CISA publishes guidance for organizations of all sizes on its post-quantum initiative page, which is a good place to look for current tools and checklists.