Harvest Now, Decrypt Later: The Quiet Threat Already Targeting Your Long-Lived Data

The quantum computing threat to encryption is usually framed as a future problem. A sufficiently powerful quantum computer, somewhere between five and fifteen years away depending on whose estimate you trust, will break the public-key cryptography protecting most of the world's sensitive data. That framing creates a comfortable distance. You have time to prepare.

What that framing misses is that adversaries do not need a quantum computer today to start benefiting from one tomorrow. They need only to collect your encrypted data now and store it until decryption becomes possible. That is the harvest-now-decrypt-later attack, also known as HNDL or store-now-decrypt-later, and it is not a theoretical future threat.
 
Nation-state actors and sophisticated adversaries are believed to be actively executing it today against targets whose data will still be valuable in ten to twenty years: government communications, intellectual property, healthcare records, financial transaction histories, and classified intelligence.

The encryption protecting that data right now is sound. The problem is that it will not be sound forever, and whoever holds the ciphertext when quantum decryption becomes viable holds everything inside it. This guide walks through how the HNDL attack works, which data is most at risk, why your current encryption does not protect you from it, and what your organization needs to do before the window closes.

What the Harvest Now Decrypt Later Attack Actually Is

HNDL is a patience-based attack strategy. The attacker does not need to break your encryption today. They intercept or exfiltrate your encrypted data through whatever means are available, store it, and wait. The decryption happens later, once the technology to do it becomes accessible.

As NIST explains, even if post-quantum encryption algorithms are implemented before sufficiently powerful quantum computers are built, a lot of encrypted data remains under threat because of the harvest-now-decrypt-later strategy. Some secrets remain valuable for many years. An adversary that captures encrypted data today and holds it can benefit from tomorrow's quantum decryption capability against data that was encrypted long before that capability existed.

The attack requires three things that sophisticated adversaries already have: the capability to intercept or access encrypted data in transit or at rest, the infrastructure to store large volumes of encrypted data for extended periods, and the anticipation that quantum computing will eventually make decryption feasible. None of those three things requires a quantum computer. The collection phase is happening now.

What makes HNDL structurally different from a traditional data breach is the time dimension. A traditional breach aims to read your data immediately. HNDL accepts that your data is unreadable today and bets on a future in which that changes. The attacker's investment is storage and patience rather than computational power.

Why Quantum Computing Makes Today's Encryption a Liability Tomorrow

Not all encryption is equally threatened by HNDL. Understanding which algorithms are vulnerable and why is the foundation for making rational prioritization decisions.

The algorithms most immediately threatened are public-key cryptographic algorithms that depend on mathematical problems believed to be computationally hard for classical computers but tractable for quantum computers. RSA relies on the difficulty of factoring large numbers. Elliptic Curve Cryptography relies on the discrete logarithm problem over elliptic curves. Diffie-Hellman key exchange relies on the discrete logarithm problem in finite fields. Shor's algorithm, running on a sufficiently powerful quantum computer, solves all three of these problems efficiently. Every TLS handshake, every certificate signature, every public-key exchange your organization relies on today uses one of these mechanisms.

Symmetric encryption is less immediately threatened. AES-256 is expected to remain secure against quantum attacks with its current key length, though Grover's algorithm reduces its effective security level, which is why some guidance recommends AES-256 over AES-128 as a precaution. For HNDL purposes, the asymmetric algorithms used during key exchange and authentication are the critical vulnerability. If an attacker captures a TLS session today, they have the encrypted payload and the encrypted key exchange. When quantum decryption arrives, both become accessible.

Q-Day, also called Y2Q, refers to the moment when a cryptographically relevant quantum computer becomes operational. Current estimates from government and academic sources range from roughly 2030 to 2040 for a machine capable of breaking today's standard key lengths. That timeline is uncertain. What is not uncertain is that data being collected today may still be sensitive when that day arrives.

Which Data Is Most at Risk

HNDL is only valuable against data that will still be worth decrypting when quantum capability matures. The practical question is not whether your data is encrypted, but how long your data will remain sensitive. The categories most meaningfully threatened include:

• Government and diplomatic communications: State secrets, negotiating positions, intelligence assessments, and diplomatic cables have value measured in decades. Foreign intelligence services have both the motive and the infrastructure to execute HNDL against government networks at scale.
• Healthcare records: Medical history, genomic data, and mental health records are sensitive indefinitely for the individuals involved and carry long-term regulatory value. Healthcare organizations are consistently high-value targets.
• Intellectual property and trade secrets: Product development plans, proprietary research, and manufacturing processes retain competitive value for years. Nation-state-sponsored industrial espionage operations are a well-documented threat category.
• Financial transaction histories: Long-term financial records, transaction patterns, and account histories are valuable for fraud, identity theft, and coercion purposes long after the original transactions.
• Legal and compliance records: Attorney-client privileged communications, regulatory filings, and internal investigations contain information whose strategic value can extend far beyond their immediate context.
• Authentication credentials and private keys: Private keys, certificate authority materials, and long-lived authentication tokens that are compromised today can be used to forge signatures and impersonate systems retroactively once decryption is possible.

If your organization creates or stores data in any of these categories, the HNDL threat is directly relevant to your current risk posture, regardless of when quantum computers arrive.

Why Your Current Encryption Does Not Protect You From HNDL

This is the point that most security communications about quantum threats underemphasize, and it is the reason HNDL requires a different response than waiting for quantum computers to arrive.

Strong encryption protects your data against attackers who want to read it now. It does not protect your data against attackers who are willing to wait. If an adversary has a copy of your AES-256-encrypted backup and the RSA-encrypted key that protects it, your current encryption is functioning exactly as designed. The problem is that the RSA component of that protection will not survive a quantum attack, and the adversary does not need it to survive now. They just need to hold it.

Extending your key lengths, rotating your certificates more frequently, and enforcing stronger cipher suites all improve your defense against current-day attacks. None of them change the fundamental situation: if an adversary holds encrypted data that was protected with quantum-vulnerable asymmetric cryptography, stronger classical keys applied now do not retroactively protect the data already collected.

The only meaningful defense against HNDL is migrating to post-quantum cryptographic algorithms before the data being collected today reaches its decryption window. This is why NIST, CISA, NSA, and government agencies across multiple countries are urging organizations to begin that migration now rather than waiting for quantum computers to become a demonstrated threat.

The NIST Post-Quantum Response and What It Means for Your Organization

NIST has led the global effort to standardize quantum-resistant cryptographic algorithms, completing a multi-year process that involved hundreds of submissions from cryptographers worldwide. In 2024, NIST published three finalized post-quantum cryptography standards:

• ML-KEM (FIPS 203): The primary algorithm for key encapsulation, replacing RSA and Diffie-Hellman in key exchange scenarios. Based on lattice cryptography.
• ML-DSA (FIPS 204): A digital signature algorithm replacing RSA and ECDSA for authentication and signing. Also lattice-based.
• SLH-DSA (FIPS 205): A hash-based digital signature algorithm providing a mathematically distinct alternative to lattice-based approaches.

In March 2025, NIST selected HQC as a fifth post-quantum algorithm, intended as a backup to ML-KEM based on different mathematical foundations. If a weakness were discovered in ML-KEM, HQC provides an alternative that does not share the same mathematical vulnerability. A draft standard is expected within approximately a year of selection.

As Infosecurity Magazine reported on NIST's finalization, the urgency of HNDL attacks is one of the explicit reasons financial and critical infrastructure sectors are moving to implement these standards as early as possible, rather than waiting for a migration deadline. Organizations in those sectors are prioritizing data with long sensitivity lifespans for early migration precisely because of the collect-now-decrypt-later threat model.

What this means for your organization practically is that the standards now exist, the algorithms are approved, and the migration path is defined. The question is no longer whether to migrate but how quickly your highest-risk data categories can be prioritized.

For security professionals connecting PQC to certification exam preparation, the free CISSP MindMaps from Destination Certification provide domain-level visual maps that show how cryptography concepts, including post-quantum threats, connect across CISSP Domain 3 and the broader security architecture framework the exam tests.

HNDL Mitigation: What Your Organization Should Be Doing Now

Effective HNDL mitigation is not a single technical fix. It is a governance program that prioritizes the right data, builds the right architecture, and executes migration in a sequence that reflects the actual risk profile of your organization's data. The steps that produce the most meaningful risk reduction in the near term:

1. Conduct a cryptographic inventory. Identify every system, application, and protocol in your environment that uses asymmetric cryptography. This includes TLS implementations, certificate infrastructure, VPN and remote access systems, code signing pipelines, authentication systems, and any application that uses RSA, ECC, or Diffie-Hellman for key exchange or signing. You cannot prioritize migration without knowing what you are migrating from.
2. Classify your data by sensitivity lifespan. Not all encrypted data is equally threatened by HNDL. Data that will still be sensitive in fifteen years represents a higher HNDL risk than data that will be irrelevant in three. Identify your highest-risk data categories: long-lived records, communications containing strategic information, and authentication materials with extended validity periods.
3. Prioritize migration for the highest-risk data categories first. NIST's migration guidance recommends prioritizing key establishment and encryption over digital signatures for HNDL-specific risk because intercepted key exchanges are the most direct HNDL attack vector. Migrate your external-facing TLS infrastructure and key exchange mechanisms for the most sensitive data before addressing lower-priority systems.
4. Build crypto agility into new systems now. Crypto agility is the architectural principle of designing systems to replace cryptographic algorithms without requiring full system redesign. Any new system your organization deploys today should be built with the assumption that its cryptographic components will need to be replaced. The crypto agility guide explains this principle and how it applies across different system types.
5. Adopt hybrid approaches during transition. NIST guidance supports hybrid implementations that combine a classical algorithm with a post-quantum algorithm during migration. This provides defense against both classical attacks and quantum attacks while post-quantum implementations mature and interoperability is established across your ecosystem.
6. Assess your data governance for long-lived sensitive records. The data lifecycle management practices your organization applies to long-lived records directly affect HNDL exposure. Data that is retained beyond its useful life expands your attack surface. Data minimization, secure deletion, and retention policy enforcement all reduce the volume of data that HNDL can target.

HNDL and the CISSP and CCSP Exam

Both CISSP and CCSP explicitly test cryptography at a governance and architecture level that includes post-quantum threats and the HNDL attack model.

The exam does not test detailed PQC algorithm specifications. It tests whether you understand why post-quantum cryptography matters, how the harvest-now-decrypt-later threat model changes the urgency of that migration, and how these concepts connect to risk management, data governance, and security architecture decisions. Understanding HNDL at a governance level is the relevant preparation target for both certifications.

For a deeper treatment of how post-quantum cryptography connects to the specific cryptography concepts CISSP and CCSP tests, the post-quantum cryptography guide maps the full PQC landscape to certification exam relevance. The asymmetric cryptography guide covers the specific algorithms that HNDL threatens and explains exactly why Shor's algorithm makes RSA and ECC vulnerable in ways that symmetric encryption is not.

Frequently Asked Questions 

HNDL Is a Present-Day Threat. The Certifications That Build PQC Readiness and Govern It Are Available Now

You now understand that harvest-now-decrypt-later is not a risk that arrives with quantum computers. It is a risk that arrives the moment your encrypted data is collected by an adversary with patience and storage. The governance response, migrating to post-quantum cryptography in a sequence that prioritizes your highest-risk data first, is not optional for organizations whose data has multi-decade sensitivity lifespans. The security professionals who will lead that response are the ones building that expertise now.

If cryptography governance, risk management, and security architecture are the competencies you want to formalize, the Destination Certification CISSP MasterClass builds the foundational security architecture and risk management thinking that governs PQC migration decisions. The CISSP is the credential that validates you can evaluate cryptographic risk at the governance level the exam demands, including quantum-era threats.

If your focus is on cloud data security and the encryption decisions that govern long-lived sensitive data in cloud environments, the Destination Certification CCSP MasterClass builds the cloud security architecture and data governance competencies that connect directly to the cloud-specific HNDL risk your organization faces. Both MasterClasses use adaptive learning systems that identify your specific knowledge gaps and adjust your study plan around your schedule.

Start with the free CCSP Cloud Security Mini MasterClass from Destination Certification to explore how cloud data encryption, key management, and the shared responsibility model connect to the data protection governance that HNDL makes urgent, before committing to a full preparation program.

The data being harvested today will be decrypted tomorrow. The security professionals who govern that risk will be the ones who prepared for it now. Destination Certification builds that preparation.