Quantum Computing and Encryption: Is Your Data at Risk?

Introduction

In 2026, quantum computing researchers narrowed their estimates for how much hardware it would actually take to break the encryption protecting most of the internet. No quantum computer capable of that attack exists yet, and none is expected within the next few years. But intelligence agencies and encrypted messaging platforms have warned for years that adversaries do not need a working machine today to start collecting your data — only the patience to wait for one. This article covers what changed in 2026, what quantum computers can and cannot do to encryption right now, and which data is actually exposed while the industry works toward a fix.

The quantum encryption threat in 2026 is about faster progress, not a working attack: no quantum computer can break RSA or ECC encryption today, but new research has cut the estimated hardware needed by roughly an order of magnitude since 2025, and adversaries are already storing encrypted data to decrypt once a capable machine exists.

Key Takeaways

No quantum computer can break RSA or ECC encryption today, but the estimated hardware requirement has dropped by roughly an order of magnitude since 2025, which is why security agencies moved the threat from a future problem to a present one.

Symmetric encryption like AES-256 is not seriously threatened by quantum computers, because Grover’s algorithm only offers a quadratic speedup that larger key sizes already absorb.

Adversaries are running harvest now, decrypt later attacks today, so any data that must stay confidential for five years or more is already exposed the moment it is captured, regardless of when a quantum computer arrives.

NIST finalized its first three post-quantum cryptography standards, FIPS 203, 204 and 205, in August 2024, giving vendors and organizations a fixed migration target instead of a moving one.

Apple’s iMessage, Signal, Google Chrome and Cloudflare have already deployed post-quantum key exchange, which shows the migration is operationally possible at internet scale, not just theoretical.

A widely reported 2023 claim that Chinese researchers had broken RSA-2048 with a quantum computer was never replicated at scale, which is a useful reminder that a small proof-of-concept and a real-world break are very different things.

What Is the Quantum Encryption Threat, Exactly?

The quantum threat targets asymmetric cryptography the algorithms that let two parties who have never met establish a secure connection or verify a digital signature. RSA, elliptic curve cryptography (ECC) and Diffie-Hellman key exchange fall into this category, and they underpin HTTPS, VPNs, email encryption and code signing across almost every system in use today.

The reason quantum computers threaten these specific algorithms is a piece of math called Shor’s algorithm. Run on a sufficiently large, error-corrected quantum computer, Shor’s algorithm can factor large numbers and solve discrete logarithm problems in a fraction of the time a classical computer would need and factoring large numbers is exactly the hard problem RSA relies on for its security. A quantum computer powerful and stable enough to run this attack against real-world key sizes is often called a cryptographically relevant quantum computer, or CRQC.

Symmetric encryption is a different story. AES-256, the cipher that actually protects the contents of your messages and files once a secure connection is established, is not seriously weakened by quantum computers. The relevant quantum attack, Grover’s algorithm, only offers a quadratic speedup rather than the exponential one Shor’s algorithm gives against RSA, and existing key sizes already provide enough margin to absorb that. This distinction matters for everything that follows: the quantum threat is a threat to key exchange and signatures, not to encryption itself.

Quantum Encryption Threat 2026: What Actually Changed

Two independent research efforts published in March 2026 one from Google Quantum AI and another from researchers at Caltech and Oratomic narrowed the estimated hardware requirements for breaking widely used encryption, according to The Quantum Insider. The publication reported that the quantum resources needed for a practical attack have dropped by roughly an order of magnitude since May 2025.

That shift is why the quantum encryption threat 2026 conversation sounds more urgent than it did even a year earlier. Google’s own president of global affairs, Kent Walker, said publicly that current encryption systems are vulnerable to quantum computing and that adversaries are already exploiting that vulnerability, according to reporting from Kiteworks not by breaking encryption outright, but by harvesting encrypted data now for later decryption. Google has also set an internal 2029 deadline for its own post-quantum cryptography migration, a signal that carries weight given that Google’s own researchers are among those producing the resource estimates that define the threat, per The Quantum Insider.

An industry coalition also designated 2026 the “Year of Quantum Security,” with launch events in January 2026 that featured senior officials from the FBI, NIST and CISA, according to The Quantum Insider. None of this means a working attack exists. It means the gap between today’s quantum hardware and a theoretical CRQC has narrowed enough that organizations planning multi-year security roadmaps can no longer treat the timeline as comfortably distant.

“Harvest Now, Decrypt Later”: The Attack Already Running

Harvest now, decrypt later sometimes called store now, decrypt later, or HNDL/SNDL describes an attack that doesn’t need a quantum computer to begin. An adversary intercepts or exfiltrates encrypted traffic or files today, stores the ciphertext, and waits. Nothing needs to be broken now, because the payoff arrives later, once a cryptographically relevant quantum computer exists.

State-linked actors have already been observed running data-theft campaigns explicitly aimed at future exploitation, according to reporting compiled by Quantum Security Defence that cites the UK’s National Cyber Security Centre. The strategy makes sense against a specific category of data: information that needs to stay confidential for five, ten or twenty years. Health records, genomic data, government and diplomatic communications, banking details, trade secrets and long-lived intellectual property are all still valuable a decade from now which means if they were captured today under RSA or ECC protection, their exposure risk is already locked in, independent of when a quantum computer actually arrives.

This is the part of the threat that makes “there’s no quantum computer yet” an unsatisfying answer. The collection phase is present tense even though the decryption phase is not.

Has a Quantum Computer Already Broken Encryption?

No, and this is worth addressing directly, because a specific claim keeps resurfacing. In January 2023, a group of Chinese researchers published a paper arguing that RSA-2048 encryption could be broken using a 372-qubit hybrid quantum-classical system. Headlines followed quickly, and the story spread faster than the caveats did.

What the researchers actually demonstrated was far smaller: they factored a 48-bit integer using a 10-qubit system, then argued the same approach would scale to break real 2,048-bit RSA keys with more qubits, according to reporting in The Register and HSToday. Independent experts, including quantum computing pioneer Peter Shor, found no evidence of a scalable quantum speedup in the method the classical mathematics the paper leaned on (a factoring approach proposed by Claus-Peter Schnorr) was already known to break down at realistic key sizes, and the quantum step didn’t fix that. A 48-bit number and a 2,048-bit RSA key differ by a factor large enough that the demonstration offered no real evidence the full attack would work.

The practical lesson is not “ignore quantum research claims.” It’s that a proof-of-concept on a toy-sized problem and a demonstrated break of real-world encryption are very different events, and headlines rarely distinguish between them.

What’s Already Quantum-Safe (and What Isn’t)

Not every part of your digital life carries the same exposure. Understanding which algorithms are actually at risk is more useful than treating “quantum computing” as a single undifferentiated threat.

The algorithms exposed to a future CRQC:

1. RSA: used for key exchange and digital signatures across TLS/HTTPS, email and code signing.
2. ECC and ECDSA: elliptic curve versions of the same functions, common in modern TLS and cryptocurrency wallets.
3. Diffie-Hellman and DSA: key exchange and signature schemes used in VPNs and older protocols.

The algorithms that remain safe:

1. AES-256 and other symmetric ciphers: the quadratic speedup from Grover’s algorithm doesn’t threaten them at current key sizes, per Cloudflare’s technical analysis of the post-quantum internet.
2. Modern cryptographic hash functions (SHA-256 and similar), used for integrity checks and password storage, for the same reason.

Meanwhile, some of the largest platforms have already moved. Apple added post-quantum cryptography to iMessage through its PQ3 protocol, which shipped with iOS 17.4, iPadOS 17.4, macOS 14.4 and watchOS 10.4 in February 2024, combining a classical elliptic-curve exchange with the Kyber-based post-quantum algorithm for defense in depth, according to Apple’s own security research team. Signal added post-quantum key establishment through its PQXDH protocol in September 2023, reported by CyberScoop. Google Chrome enabled post-quantum key exchange by default starting with version 124 in April 2024, using the X25519Kyber768 combination, according to Kaspersky’s analysis of PQC rollouts. Amazon Web Services introduced a post-quantum variant of TLS 1.3 for its Key Management Service as early as 2020 and has updated it since, per the same analysis. Cloudflare reported in its own technical blog that close to two percent of TLS 1.3 connections through its network were already using post-quantum cryptography in early 2024.

The takeaway: the migration is real and already running in the background of tools you likely use every day. That doesn’t eliminate the exposure window for everything else it just means part of the problem is already being handled without your involvement.

For a look at how the broader security model of verifying every connection rather than trusting a network perimeter is reshaping defenses, Arcnet’s guide to Zero Trust Security covers the underlying principles.

NIST’s Post-Quantum Cryptography Standards, Explained

The US National Institute of Standards and Technology finalized its first three post-quantum cryptography standards on August 13, 2024, following an eight-year public evaluation process, according to NIST’s Computer Security Resource Center and the Federal Register notice announcing them. These standards give the industry a concrete target to build toward, replacing years of “post-quantum cryptography is coming” with an actual specification vendors can implement.

Standard	Algorithm	Derived from	Replaces / purpose
FIPS 203	ML-KEM	CRYSTALS-Kyber	Key exchange (replaces RSA/ECDH)
FIPS 204	ML-DSA	CRYSTALS-Dilithium	Digital signatures (replaces ECDSA/RSA signatures)
FIPS 205	SLH-DSA	SPHINCS+	Hash-based signatures, a conservative fallback

NIST also selected a fourth algorithm, HQC, for standardization on March 11, 2025, intended as a structurally different backup key-encapsulation method in case a weakness is later found in the lattice-based approach behind ML-KEM, per NIST’s Computer Security Resource Center. A fifth standard covering the FALCON signature algorithm, expected as FIPS 206, was still in development as of this writing.

Most real deployments today run these algorithms in hybrid mode pairing a classical algorithm with its post-quantum counterpart, as Apple’s PQ3 and Chrome’s X25519Kyber768 both do so that the connection stays secure even if a weakness is later discovered in the newer, less battle-tested post-quantum math.

Is Your Data at Risk? How to Tell

Rather than treating quantum risk as all-or-nothing, weigh your own data against these factors.

1. Confidentiality lifetime: if the information must stay secret for five years or more, harvest now, decrypt later already applies to it, regardless of when a quantum computer arrives.
2. Exposure surface: data that travels over networks, sits in cloud storage, or lives in backups an adversary could exfiltrate is at risk; data that never leaves an air-gapped system is not, at least not from this specific threat.
3. The algorithm actually protects it: RSA, ECC and Diffie-Hellman-based protections are exposed; AES-256 and modern hashing are not.
4.  Who would want it later: nation-state actors running harvest campaigns target government, defense, healthcare, financial and intellectual-property data far more than routine personal browsing.
5. Whether your vendor has already migrated if the platform or service you rely on has publicly adopted post-quantum cryptography, as several major providers have, your exposure window on that specific channel is already narrowing without any action from you.

Data that clears several of these criteria: long shelf life, network exposure, RSA or ECC protection, and clear value to a patient adversary is the category actually worth prioritizing, not every email you’ve ever sent.

What Individuals Can Actually Do About It

For most everyday accounts and browsing, urgent individual action isn’t necessary yet, because the largest platforms are migrating on the server side without requiring anything from users. Keeping your phone, browser and messaging apps updated is the single most effective step, since that’s how you inherit post-quantum protection when a vendor like Apple, Google or Signal ships it as they already have.

Day-to-day activity like online banking and password logins depends heavily on symmetric encryption once a session is established, which isn’t seriously threatened by quantum computers, so there’s no need to panic about passwords specifically because of this threat. Where it’s worth paying closer attention is data you specifically need to stay confidential for a decade or more, sensitive documents shared through smaller or lesser-known apps, legal or medical records handled outside major platforms, or long-term archival storage. For that category, checking whether the service has announced quantum safe support, or choosing one that has, is a reasonable and proportionate step.

If your organization is also weighing newer risks alongside this one, Arcnet’s explainer on agentic AI security risks is a useful companion read for building out a current threat model.

What Organizations Should Do: The Migration Roadmap

For organizations, the shift from “someday” to “now” changes how migration should be planned. The roadmap that security vendors and standards bodies converge on looks like this:

1. Build a cryptographic inventory to locate every place RSA, ECC, Diffie-Hellman, certificates and keys are actually used, across cloud, on-premises and operational technology environments, per Fortinet’s guidance on crypto-agility.
2. Prioritize by data sensitivity and retention length rather than by system size, following the staged approach NIST outlines in its transition guidance, as summarized by Entrust high-value, long-lived data moves first.
3. Adopt crypto-agility architecture that lets algorithms be swapped without a full system redesign, so the next standard doesn’t require starting over, per Keyfactor’s education resources on the topic.
4. Pilot hybrid classical-plus-post-quantum deployments before a full cutover, and test for the larger key and signature sizes PQC algorithms introduce, which can affect load balancers, certificates and latency-sensitive systems, according to Palo Alto Networks’ migration guidance.
5. Align vendor and procurement requirements so new systems already support NIST-approved algorithms, rather than adding another legacy system to migrate later, also per Palo Alto Networks.

Regulatory pressure varies by region and is still developing, so name the rules that actually apply to your organization rather than assuming a single global deadline. In the United States, the NSA’s CNSA 2.0 guidance sets 2030 as the mandatory migration deadline for National Security Systems, and NIST’s transition guidance deprecates RSA-2048 and ECC P-256 for new federal systems after 2030, with full disallowance after 2035, according to research published on arXiv and analysis from QNu Labs. Organizations outside the US should check the equivalent guidance from their own national cybersecurity authority rather than assume the American timeline applies to them. Insurers are also starting to factor this in: Lloyd’s of London syndicates were reported to be asking applicants to document post-quantum migration plans as part of 2026 cyber-insurance renewals, per QNu Labs’ reporting placing crypto-agility in the same review category as multi-factor authentication.

For a broader framework on triaging which vulnerabilities to fix first once the inventory is built, see Arcnet’s guide to risk-based vulnerability management with CVSS scores.

Where This Leaves You

No quantum computer can read an RSA-protected message today, and that isn’t likely to change in the next few years. But the risk the quantum encryption threat 2026 represents comes from the data being collected right now, not from a machine that exists yet – which is why the safest working assumption is that anything you need kept confidential for the next decade should already be moving toward quantum safe protection. If you manage infrastructure, start with a cryptographic inventory and a realistic look at what NIST’s post-quantum cryptography standards mean for your stack. If you’re a general reader, keep your software updated and let the platforms you already use do the migration work in the background. This is the fastest-moving part of the cybersecurity story right now, so it’s worth checking back as the timeline keeps compressing.

FAQs

1. What is the quantum encryption threat to my data right now?

Right now, the threat is data collection, not decryption. Adversaries are storing encrypted traffic and files today so they can decrypt them later, once a quantum computer capable of breaking RSA or ECC exists a strategy called harvest now, decrypt later. No working attack exists yet.

2. When will quantum computers break encryption?

There’s no confirmed date. Estimates have compressed significantly since 2025 as new research narrowed the hardware requirements, but a cryptographically relevant quantum computer capable of breaking real-world RSA or ECC keys does not exist yet, and most timelines still place a working attack years away.

3. Is my VPN or online banking safe from quantum computers?

For day-to-day use, yes – the symmetric encryption that protects your actual data (like AES-256) isn’t seriously threatened by quantum computers. The exposure is in the key-exchange step that sets up the connection, which is why some VPN providers and browsers have already added post-quantum key exchange as an extra layer.

4. What is harvest now, decrypt later?

Harvest now, decrypt later (HNDL) describes adversaries intercepting and storing encrypted data today with the intention of decrypting it once a powerful enough quantum computer exists. It’s the reason the quantum threat is treated as present tense rather than a distant future problem.

5. Do I need to do anything now to protect my data from quantum computers?

For most personal use, keeping your devices and apps updated is enough, since major platforms are already migrating server-side. If you handle data that must stay confidential for a decade or more, check whether the specific service you use has adopted post-quantum cryptography.

6. What is post-quantum cryptography?

Post-quantum cryptography refers to encryption and signature algorithms designed to resist attacks from quantum computers. NIST finalized its first three standards FIPS 203, 204 and 205 in August 2024, and major platforms including Apple, Signal, Google Chrome and Cloudflare have already begun deploying them.