The Data Thief Who Is Happy to Wait Until 2035
Most cyber attacks work on a reasonably tight timescale. Steal credentials, exfiltrate data, ransom the lot before anyone notices. But there's another category of threat entirely: adversaries who don't need your information this week, or even this year. They're quite content to steal encrypted data now and simply wait until quantum computers become powerful enough to crack it open like a particularly stubborn jar of pickles.
It's called "harvest now, decrypt later," and it's less a hypothetical scenario than an ongoing problem. Security agencies warn that well-resourced adversaries may already be intercepting and storing encrypted communications and data, banking on the likelihood that within the coming years, quantum computing will render current encryption standards about as protective as a tissue-paper umbrella.
Why Quantum Computing Changes Everything
Current encryption relies on mathematical problems that are extremely difficult for classical computers to solve. RSA encryption, for instance, depends on the fact that factoring large numbers takes an impractical amount of time. Your laptop would need several lifetimes to crack a properly encrypted message using brute force.
Quantum computers operate differently. They exploit quantum mechanical properties to perform certain calculations exponentially faster than classical machines. Once quantum computers reach sufficient scale and stability—what's called "cryptographically relevant quantum computers" or CRQCs—they'll be able to break the encryption algorithms that currently protect everything from your online banking to classified government communications.
We're not there yet. Today's quantum computers are impressive from a physics perspective but still quite limited in practical application. The question isn't whether they'll eventually break current encryption, though. It's when. Predictions vary considerably, and nobody knows for certain when a cryptographically relevant quantum computer will arrive—but the risk is considered credible enough to warrant preparing now.
What's Actually Worth Stealing Today?
The harvest-now-decrypt-later strategy only makes sense if the data in question will still be valuable in 2035 or beyond. Your average consumer's online shopping habits probably won't merit the storage costs. But certain categories of information age like fine wine, at least from an adversary's perspective.
Government communications and classified intelligence top the list. Diplomatic cables, military planning documents, and strategic assessments don't lose relevance just because a few years have passed. Medical research, particularly around sensitive health conditions or pharmaceutical development, maintains value for decades. Financial institutions hold long-term strategic plans, merger discussions, and client information that remains useful well into the future.
Intellectual property—especially in sectors like aerospace, defence, biotechnology, and advanced manufacturing—often has a shelf life measured in decades rather than months. If you're developing new materials, propulsion systems, or medical treatments, your research data today could still provide competitive advantage to a rival in fifteen years' time.
Personal information can also retain value, particularly for individuals in sensitive positions. Compromising material about politicians, senior civil servants, military officers, or corporate executives doesn't become less useful merely because it's old. If anything, as people advance in their careers, information collected about them years earlier might become more valuable.
Taking Inventory Before the Clock Runs Out
The National Cyber Security Centre has issued clear guidance: organisations need initial migration plans completed by 2028 and full migration to post-quantum cryptography finished by 2035. That's not arbitrary deadline-setting for the sake of it. It's based on realistic assessments of how long it takes large organisations to identify vulnerable systems, test new cryptographic standards, and implement changes across complex infrastructure.
The first step is inventory. You need to know what data you hold, where it lives, how it's protected, and how long it needs to remain confidential. This isn't a quick spreadsheet exercise. Many organisations discover they have encrypted data scattered across systems they'd half-forgotten about, protected by cryptographic implementations buried in legacy applications that haven't been touched in years.
You're looking for anything using algorithms vulnerable to quantum attacks. That includes systems relying on RSA, elliptic curve cryptography (ECC), and Diffie-Hellman key exchange for key establishment and session protection. While bulk data is typically encrypted using symmetric algorithms, it's the public-key cryptography protecting those keys and sessions that's vulnerable. Break the key exchange, and you can potentially access the symmetric keys used to encrypt the actual data. Information protected by these methods today could be readable by quantum computers in the future, even if you migrate to quantum-resistant algorithms later. The protection that secured it during transmission or storage will have already been compromised.
This makes the current moment rather critical. Data harvested today is data at risk tomorrow. If you're transmitting or storing information that must remain confidential beyond the next decade, you need to start thinking about quantum-resistant protection now, not in 2034 when everyone's suddenly in a rush.
Why Migration Takes Longer Than You'd Think
Swapping out cryptographic algorithms sounds straightforward until you actually try to do it. Modern organisations run on interconnected systems where cryptography is embedded in dozens of places: communication protocols, database encryption, authentication systems, backup processes, cloud storage, API connections, and more.
Post-quantum cryptographic algorithms are already being standardised by organisations like NIST (the US National Institute of Standards and Technology), but implementing them across existing infrastructure requires extensive testing. The new algorithms have different performance characteristics, key sizes, and computational requirements. Something that works perfectly in a test environment might cause unexpected problems when rolled out to production systems handling thousands of transactions per second.
Then there's the compatibility challenge. You can't switch everything over on a single Tuesday afternoon. During the transition period, systems need to support both current and post-quantum cryptography, which adds complexity. Third-party services, partner organisations, and legacy systems all need to be accounted for. Some might not support new standards for years.
This is why the NCSC timeline extends to 2035. It's not padding. It's a realistic assessment of how long it takes to migrate complex, mission-critical infrastructure without breaking everything in the process.
What Happens If You Wait
The temptation to postpone this work is understandable. Post-quantum cryptography migration is expensive, technically challenging, and addresses a threat that feels somewhat abstract. Quantum computers capable of breaking current encryption don't exist yet. Why not wait until they're closer to reality?
Because by then, years of your encrypted data will already be sitting in an adversary's storage systems, waiting to be decrypted. You can't retroactively protect information that's already been intercepted. Once it's harvested, it's vulnerable, regardless of when you eventually upgrade your encryption.
For organisations handling genuinely sensitive information—government agencies, defence contractors, healthcare providers, financial institutions, research facilities—the time to act is now. Not in a state of panic, but with the understanding that preparation for 2035 needs to begin considerably earlier than 2034.
More Reading on the Paranoid Side of Technology
If you've found this descent into cryptographic anxiety useful, you'll be pleased to know we've written rather a lot about security and privacy. It's the sort of thing that keeps coming up when you build systems that need to actually work in the real world. Have a browse through our other articles on the subject—there's plenty to keep you occupied if you're the type who enjoys contemplating all the ways things might go wrong.
The Secret Code: What is Encryption
Incognito Mode: The Privacy Feature That's Mostly Just Hiding Things From Your Mum
What happens to your business data when you use free online tools
Why We Talk About Security and Privacy
We write about security and privacy because it's fundamental to how we build things. Not as an afterthought or a compliance checkbox, but as a core requirement from the start. The software and systems we create need to handle sensitive information responsibly, which means understanding threats that most people would rather not think about. Post-quantum cryptography, data protection, secure architecture—these aren't optional extras. They're how you build things that won't embarrass you in ten years' time.
Should you need a website built or software created by people who think about security before it becomes a problem rather than after, we'd be happy to talk. We're the sort who read NCSC guidance for fun and consider cryptographic migration timelines before they become urgent. If that sounds like the kind of approach you'd appreciate, get in touch. We promise to worry about the complicated bits so you don't have to.
What does 'harvest now, decrypt later' mean?
It's when attackers steal encrypted data today and store it, planning to decrypt it once quantum computers become powerful enough to break current encryption—potentially within the next decade or so. Security agencies warn that well-resourced adversaries are likely already doing this with sensitive communications and data.
When will quantum computers be able to break current encryption?
Nobody knows for certain, but predictions vary enough that governments are taking it seriously. The UK's National Cyber Security Centre recommends organisations complete migration to quantum-resistant encryption by 2035, which gives you a sense of the timeframe experts are working with.
What kind of data is actually worth stealing for decrypt later attacks?
Anything that stays valuable for years: government intelligence, military planning, medical research, pharmaceutical development, intellectual property in aerospace or biotechnology, and long-term financial strategies. Even personal information about people in sensitive positions can become more valuable as their careers progress.