Every intrusion in this publication’s back catalogue shares an assumption: that once an attacker is out of the network, the clock on the damage stops ticking. Harvest Now, Decrypt Later (HNDL) breaks that assumption. It describes a nation-state strategy that does not need to succeed today to succeed eventually — intercept or exfiltrate encrypted traffic now, store it cheaply, and wait for a cryptographically relevant quantum computer (CRQC) to make the ciphertext readable. CISA, the NSA, and NIST have warned since August 2023 that this collection is plausibly already underway, not a hypothetical for the 2030s. The uncomfortable part for defenders is that the exposure is retroactive: data encrypted and intercepted this month could be unlocked in five years, and there is no patch that reaches backward in time to protect it.
This is why HNDL belongs in a threat-intelligence conversation rather than purely a cryptography one. It reframes “confidentiality” from a property you either have or don’t into a race between how long your data needs to stay secret and how fast quantum hardware arrives. For government communications, genomic and health records, M&A negotiations, and long-lived industrial control credentials, that race may already be lost — the sensitive window outlasts any realistic migration timeline.
The economics make this rational, not paranoid
Skepticism about HNDL usually centers on cost: why would an adversary bother storing petabytes of ciphertext it cannot read? The economics answer that cheaply. Commodity hard-drive storage runs under $20,000 per petabyte, and intercepted TLS 1.2/1.3, QUIC, and SSH sessions compress well. A March 2026 arXiv analysis (2603.01091) concluded that retaining bulk intercepted traffic is “economically trivial” for an actor with nation-state signals-intelligence budgets. The attack has three stages — intercept, store, decrypt — and the first two require none of the quantum breakthroughs the third depends on. An adversary can be fully committed to a decades-long HNDL program using nothing more exotic than existing collection infrastructure and a server room.
That collection infrastructure is not theoretical. Salt Typhoon, the Chinese state-linked campaign that this publication and others have covered extensively through 2026, compromised at least nine U.S. telecommunications carriers — including AT&T, Verizon, T-Mobile, and Lumen — and reached into lawful-intercept systems, the infrastructure telecoms maintain to comply with court-ordered wiretaps. The FBI has said more than 600 organizations across over 80 countries were of interest to the operation. To be clear: Salt Typhoon has not been publicly confirmed by investigators as an HNDL operation specifically. What it demonstrates is something more foundational — that the access required to harvest encrypted traffic at carrier scale, indiscriminately and over a long period, is not a hypothetical capability reserved for future quantum-era adversaries. It already exists, operated by an actor with an explicit strategic interest in long-horizon intelligence collection against the same encrypted sessions a quantum computer would eventually be needed to break.
The timeline just compressed, twice
For years, defenders could reasonably treat CRQC arrival as distant enough to deprioritize. That comfort has eroded through a sequence of resource-estimate revisions rather than a single headline event.
In 2019, Google’s Craig Gidney estimated that factoring a 2048-bit RSA key would require roughly 20 million noisy qubits. In May 2025, Gidney published a revised estimate — using algorithmic improvements including approximate residue arithmetic and more efficient error-correction layouts — putting the figure at under one million qubits, with the factoring run completing in under a week of continuous operation. Coverage of the paper noted Google had moved to accelerate its own PQC migration, reportedly targeting substantial completion around 2029, citing the revised estimate as a factor. According to the Cloud Security Alliance’s research note on enterprise HNDL exposure, at least three further papers published between May 2025 and March 2026 continued the trend, with one March 2026 result suggesting fewer than 100,000 physical qubits could suffice for RSA-2048, and under 500,000 for the equivalent elliptic-curve problem.
Those are hardware-resource estimates, not demonstrated attacks — current quantum processors operate in the low thousands of physical qubits, nowhere near the scale or the sustained low-error-rate operation a real attack would require. Forrester’s 2026 analysis projects practical, broadly useful quantum computing — and with it, meaningful Q-Day risk — arriving around 2030. IonQ’s CEO has separately put the company’s internal target for reaching logical-qubit thresholds sufficient to challenge RSA-2048 at 2028–2029, though analysts are careful to describe that as a hardware roadmap milestone from a vendor with a commercial interest in the outcome, not an independently verified Q-Day forecast. The honest summary: the published range among serious estimators has compressed to roughly 2028–2035, down from “several decades out” as recently as 2023, and it compressed because the qubit counts required kept falling, not because anyone built a bigger machine.
For an HNDL calculus, the resource-estimate trend matters more than any single point prediction. Every reduction in required qubits shortens the effective shelf life of data encrypted with RSA or classical elliptic-curve cryptography today — and shortens it for data that was already intercepted and archived yesterday.
The regulatory clock is running well ahead of the hardware clock
Standards bodies and national-security agencies have stopped waiting for certainty and started legislating against the estimate curve. NIST finalized its first three post-quantum standards — FIPS 203 (ML-KEM, for key establishment), FIPS 204 (ML-DSA, for signatures), and FIPS 205 (SLH-DSA, a stateless hash-based signature scheme) — on August 13, 2024, with HQC added as a backup key-encapsulation mechanism in March 2025. The harder problem NIST has since turned to is forcing deprecation of what those standards replace. Draft guidance in NIST IR 8547 designates 112-bit-security algorithms — RSA-2048 and ECC P-256 among them — for deprecation around 2030 and full disallowance by 2035, meaning federal systems would be barred from using them at all, including in legacy deployments, past that date.
The NSA’s parallel CNSA 2.0 suite is more operationally concrete because it carries hard national-security-system deadlines rather than federal civilian guidance: new acquisitions must support quantum-resistant algorithms (ML-KEM-1024, ML-DSA-87, alongside AES-256 and SHA-384/512) by January 1, 2027; legacy equipment that cannot be upgraded must be phased out by the end of 2030; CNSA 2.0 becomes mandatory across covered systems in 2031; operating systems, custom applications, and cloud services must reach exclusive use by 2033; and the entire national-security-system estate is expected to be fully migrated by 2035. The EU’s NIS Cooperation Group published its own roadmap in June 2025: member states publish national PQC strategies and begin cryptographic inventories by the end of 2026, critical infrastructure completes high-risk migration by 2030, and medium-risk systems follow by 2035. The UK’s NCSC uses a similar three-stage structure — discovery by 2028, high-priority system migration by 2031, full migration by 2035.
What all four frameworks share is an implicit acknowledgment that 2030–2035 is treated as the outer edge of safe, not a comfortable buffer. Regulators are not betting that quantum computers capable of breaking RSA-2048 will arrive on a specific date; they are betting that the cost of being wrong in the “too early” direction is manageable, while the cost of being wrong in the “too late” direction — with HNDL collection already underway against current traffic — is not.
Enterprises are nowhere close to those deadlines
Every available survey converges on the same conclusion: migration intent is high, migration execution is not. ISACA’s 2025 survey of more than 2,600 practitioners found 62% concerned about the quantum threat to encryption, but only around 5% reporting a defined transition strategy. The IBM/Cloud Security Alliance Quantum-Safe Readiness Index, based on roughly 750 executive respondents, put average organizational readiness at 25 out of 100, with a reported 36% skills shortfall in the practitioners needed to execute a migration. Only about 37% of organizations report having implemented any crypto-agility framework — the architectural property that lets an organization swap cryptographic algorithms without a ground-up rebuild — while 62% report critical systems that cannot support post-quantum algorithms without a hardware refresh.
Protocol-level mechanics make the gap worse than the percentages suggest. Hybrid key exchange (classical plus post-quantum, deployed so that an attacker must break both to gain anything) is now reasonably common — reportedly around half of measured domains support it — but post-quantum digital certificates remain almost entirely absent from production traffic, with public, broadly trusted PQC X.509 certificates not expected before 2027. Some of the new algorithms do not fit cleanly into legacy protocol constraints at all: ML-DSA signatures run 2,420–4,627 bytes and SLH-DSA signatures can reach nearly 50,000 bytes, both far exceeding the 512-byte practical limit for DNS-over-UDP responses, which makes DNSSEC and BGP security — infrastructure-layer trust mechanisms nobody budgets to rebuild — unusually hard migration targets.
Sector exposure tracks data lifetime, which is exactly the variable HNDL weaponizes. Healthcare records are subject to retention obligations running 50-plus years under HIPAA-adjacent rules while running on devices with 5–25 year refresh cycles, leaving an estimated near-totality of records encrypted today still exposed when a CRQC arrives within that window. The Bank for International Settlements has urged financial institutions to begin migration now; a December 2025 test of PQC-signed transfers in the Eurosystem’s TARGET2 platform (Project Leap Phase 2) hit performance and packet-size failures under the new signature schemes, and no hardware security module vendor had, as of early 2026, achieved FIPS 140-3 Level 3 validation with post-quantum algorithms inside the validated cryptographic boundary. A Federal Reserve working paper from September 2025 added a detail with no migration fix at all: post-quantum cryptography cannot retroactively protect data already permanently recorded on public distributed ledgers, meaning blockchain transaction histories are exposed by design regardless of when the ecosystem around them migrates.
What this means for threat-intel and security teams now
HNDL does not change what defenders should have already been doing about data classification — it changes the urgency and the ordering. Three implications follow directly from the material above:
Data lifetime, not data sensitivity alone, should drive migration priority. A secret that needs to stay confidential for six months is a lower HNDL priority than a moderately sensitive record that must stay confidential for fifteen years, because the latter is far more likely to still be “live” when a CRQC arrives. Cryptographic inventories — the first step in every government framework above — should be scored against retention requirements, not just classification level.
Interception capability is the leading indicator, and it already exists. Organizations do not need to wait for confirmation that a specific actor is running an HNDL program to treat the risk as current. Any adversary already capable of bulk interception — through compromised telecom infrastructure, VPN concentrators, or cloud egress points, the same access patterns this publication has covered under Salt Typhoon, Volt Typhoon, and related campaigns — has what it needs for the “harvest” half of the strategy today. The “decrypt” half is a hardware problem on someone else’s roadmap, not a gate on current risk.
Crypto-agility is now a board-level control gap, not an IT backlog item. With only roughly a third of organizations reporting any crypto-agility framework and HSM vendors still lacking validated PQC implementations, the practical bottleneck is less “which algorithm to pick” — NIST settled that in August 2024 — and more “can this environment change algorithms at all without multi-year hardware replacement.” That is an architecture and procurement question that long predates any specific quantum milestone, and it is the question the 2027–2031 wave of CNSA 2.0 and EU deadlines is actually testing.
The quantum computer capable of breaking RSA-2048 may be four years away or it may be ten. What is not uncertain is that today’s intercepted, encrypted, long-lived data is being filed away against that date by actors who have already shown they have the access to collect it at scale. For threat intelligence, HNDL is not a forecast. It is a breach with a delayed fuse, and the fuse is already lit on traffic moving across the internet right now.