“Harvest now, decrypt later” — why your encrypted data is already being stolen for a computer that doesn’t exist yet

That is the whole idea behind “harvest now, decrypt later.” Record what you cannot read. Store it. Wait for the maths to change. What is different in 2026 is that we can see the change coming, and put a rough date on it.

The bet an adversary is making

Almost everything you do online relies on two kinds of cryptography. Symmetric encryption — AES, in practice — scrambles the data itself, and stands up reasonably well to quantum attack; the best-known one merely halves its effective strength, which longer keys solve. Asymmetric encryption — RSA, Diffie-Hellman, elliptic curve — does something narrower and far more fragile: it lets two machines that have never met agree on a shared secret over a wire anyone can listen to. A large enough quantum computer running Shor’s algorithm breaks it outright.

So the exposure is the handshake. Record a TLS session today — the whole thing, handshake included — and a machine that can later break the key exchange recovers the session key and decrypts everything that followed. Retrospectively. In bulk.

Here is the part most people get wrong: perfect forward secrecy does not save you. It generates a fresh ephemeral key per session, so a server key stolen in 2030 won’t unlock traffic from 2026. But that ephemeral key is still negotiated with elliptic-curve Diffie-Hellman — precisely what Shor’s algorithm dismantles. Forward secrecy raises the attacker’s cost. It doesn’t remove the exposure.

The honest version of the threat

This is where vendor writing tends to overreach, so it’s worth being precise: there is no public evidence of a specific archive of Australian ciphertext sitting in a warehouse waiting for Q-Day. Agencies phrase this carefully — adversaries could be collecting data now — and the hedging is deliberate.

The case rests on capability, incentive and precedent. Bulk interception demonstrably happens; Salt Typhoon’s intrusions into major telecommunications carriers proved the access. Storage is cheap enough that keeping a decade of traffic costs close to nothing. And VENONA shows the strategy works, and that intelligence services will wait decades for it to pay off.

That isn’t proof. It’s a well-founded reason to migrate. Anyone selling you certainty here is selling you something.

The equation that decides whether you should care

Michele Mosca, at the Institute for Quantum Computing in Waterloo, reduced the question to an inequality that fits on a napkin. Let x be the years it takes you to migrate, y the years your data must stay confidential, and z the years until a cryptographically relevant quantum computer exists. If x + y > z, your data is already exposed.

Run it against a real Australian example. Private health providers in NSW, Victoria and the ACT must keep an adult’s records seven years from the last service, and a child’s until they turn 25. Organisations in My Health Record face 30 years after death — or 130 years from date of birth where the death is unknown. Merger negotiations, patent applications, source identities, family court files — decades, not quarters.

Now the other side. The Global Risk Institute’s expert survey puts the central estimate for such a machine in 2033–2037. Google — which builds quantum computers and runs Chrome, Android and one of the world’s largest clouds — said in March 2026 it is targeting 2029 to finish its own migration, citing faster-than-expected progress in hardware and error correction.

Set x at three years for a mid-sized organisation with a competent IT function, and y at a conservative fifteen for legal or health records. That data needs Q-Day no earlier than 2044. Nobody serious is forecasting that.

The uncomfortable conclusion isn’t that quantum computers will break your encryption in 2034. It’s that the deadline for protecting data you sent in 2026 was 2026.

The hardware curve is bending — in Queensland

Estimates of what it takes to break RSA-2048 have collapsed. In 2019, Craig Gidney and Martin Ekerå put it at roughly 20 million noisy qubits for eight hours. In May 2025, Gidney revised that to fewer than one million, under a week. None of that hardware exists yet — but the target keeps moving toward the machines, not away.

Australians have a front-row seat. In June 2026, PsiQuantum broke ground at Moreton Bay — an hour down the highway from our office — on what it says will be the world’s first utility-scale, fault-tolerant quantum computer, in the regime of one million physical qubits, backed by roughly A$940 million from the Commonwealth and Queensland governments.

In fairness: that machine is for chemistry, materials science and medicine, not for reading anyone’s VPN traffic, and nobody has yet demonstrated fault tolerance at commercial scale. But the curve is being climbed — with public money, in south-east Queensland.

What Australia has already decided

Two years ago this week, on 13 August 2024, NIST published the first finalised post-quantum standards: FIPS 203 (ML-KEM) for key establishment, FIPS 204 and 205 for signatures. Not research projects — standards, with running code.

Australia then went further than almost anyone. The ASD’s December 2024 update to the Information Security Manual introduced controls ISM-1990 to ISM-1995, approving specific ML-KEM and ML-DSA parameter sets, and set an end date for traditional asymmetric cryptography — RSA, Diffie-Hellman, ECDH and ECDSA — of the end of 2030. That’s five years ahead of NIST’s own 2035 disallowance date, and the most aggressive general-purpose deadline in the world.

The ACSC’s milestones are worth pinning to a wall:

• End of 2026 — a refined transition plan reflecting your data’s value, dependencies and risk tolerance.

• End of 2028 — transition commenced, starting with critical systems and data.

• End of 2030 — transition complete.

It is September 2026. The first milestone is three months away.

There’s a procurement obligation alongside it that’s easy to miss. ISM-1917 requires future cryptographic dependencies to be considered in new purchases — so anything with a service life past 2030 should already support ASD-approved algorithms. Buying a five-year appliance in 2026 without asking is quietly buying a replacement project.

Sector expectations are converging too. At the 2026 AFIA Risk Summit, APRA said it wants regulated entities to at least begin mapping where cryptography is relied upon across their systems, data and third parties, explicitly including long-lived data. Under the SOCI Act, a risk management program that hasn’t assessed the quantum horizon gets harder to defend each year.

The good news: half of this is nearly free

The most urgent piece — protecting data in transit against recording — is further along than most boards realise, and often arrives as a software update.

Hybrid post-quantum key agreement is already the majority case on the web. Cloudflare reported in April 2026 that more than half the human traffic it handles uses X25519MLKEM768, which pairs the classical elliptic-curve handshake with ML-KEM-768 so the connection survives even if one is later broken. In early 2024 that figure was about 2%. Signal has protected message key agreement since 2023; Apple’s iMessage since 2024.

The gap is on the server side, where Cloudflare’s scanning finds roughly 10% of customer origin servers supporting post-quantum key exchange. Browsers have moved; the systems Australian businesses run have not. For many organisations the fix for data in transit is upgrading a TLS library and setting a cipher preference — hours of work, not a program of work.

Signatures are the harder half, and mercifully the less urgent: forging one needs a quantum computer in hand at the moment of attack. That’s a future problem. A recorded handshake is a today problem.

Where to start, in the order that matters

The instinct is to start with your most critical systems. For this threat, that’s the wrong sort. Start with your longest-lived data.

1. Inventory data by shelf life, not by system. Ask one question of every dataset: how long must this stay secret? Patient records, legal files, IP and research, M&A material, board papers, source identities, anything with a statutory retention period. Ten years or more puts it in scope now.

2. Build a cryptographic inventory. You cannot migrate what you cannot see. Certificates, keys, algorithms, libraries, VPN tunnels, HSMs, embedded devices, and the dependencies buried inside third-party products. This discovery work is the bulk of the effort.

3. Turn on hybrid PQC wherever it costs nothing. Modern TLS libraries, browsers, CDNs and VPN products increasingly support X25519MLKEM768 out of the box. Internet-facing services first.

4. Don’t forget data at rest and backups. Long-term archives encrypted with today’s key wrapping inherit the same problem. Where records must survive decades, plan for re-encryption.

5. Build for crypto-agility, and own it at board level. ML-KEM won’t be the last algorithm you deploy; an environment where algorithms can change without an architectural rewrite is the real deliverable. Regulators assess process as much as outcome — document the decision.

A final word

There is a version of this topic that is all countdown clocks and hypothetical machines, and it deserves the scepticism it gets. This is not that. The standards are finalised. The algorithms are already in libraries you use. The regulator has published dates, and Australia’s are earlier than anyone else’s. The only genuinely uncertain variable is when the machine arrives — and it’s the one your planning cannot depend on.

The deadline for protecting long-lived data was never Q-Day. It was the day the data was sent. For much of what Australian organisations hold, that day has passed — which makes the only useful question the one about everything from here.

Three months to a plan. That’s enough time, if you start.

 

Xiph Cyber helps Australian organisations get ahead of the post-quantum transition — cryptographic discovery and risk audits that map where your long-lived data actually lives, ASD-aligned transition planning against the 2026/2028/2030 milestones, encrypted hardware and secure communications built for confidentiality that has to outlast the decade, and vCISO support for organisations without a full-time security leader. Get in touch and you’ll speak to a real person within 24 hours.

 

Further reading

• ASD, Planning for post-quantum cryptography — https://www.cyber.gov.au/business-government/secure-design/quantum/planning-for-post-quantum-cryptography

• ASD, Information Security Manual — Guidelines for cryptography — https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism

• NIST, Post-Quantum Cryptography standards (FIPS 203, 204, 205) — https://csrc.nist.gov/projects/post-quantum-cryptography

• Cloudflare, State of the post-quantum Internet — https://blog.cloudflare.com/pq-2025/

• Cloudflare Radar, post-quantum adoption data — https://radar.cloudflare.com/post-quantum

• OAIC, Notifiable Data Breaches publications — https://www.oaic.gov.au/privacy/notifiable-data-breaches