🛡️ **DEVELOPING — Harvest Now, Decrypt Later Threat: Data Collection Underway; PQC Transition Timeline Compressed**

Published Thursday, September 10, 2026 at 05:04 AM PT

BLUF: Adversaries are actively harvesting encrypted data today for future decryption once quantum computers break current encryption. The vulnerability window is not future—it opened when data was encrypted. Organizations must begin post-quantum cryptography (PQC) migration immediately; business leaders frequently dismiss quantum threats as “ten years out” and delay action, but the operational timeline is NOW. No specific sector or incident yet, but CSO Online reporting signals elevated CISO attention to this threat model.

DETAILS:

• Threat model confirmed: “Harvest now, decrypt later” is a documented attack strategy where threat actors collect encrypted data in transit and at rest today, betting they will possess quantum-capable decryption within years. The threat is not speculative—data collection is active.

• Timeline vulnerability is present: The critical clock did not start when quantum computers arrive; it started when sensitive data was encrypted with algorithms vulnerable to quantum decryption (AES, RSA, ECC-based systems). That data is already in adversary hands or accessible via interception.

• Migration urgency widely underestimated: Leadership consistently deprioritizes PQC transition, attributing quantum threats to a distant future (“ten years out”) and deferring budget allocation. This directly enables harvest-now scenarios by delaying cryptographic hardening.

• Post-quantum cryptography is the remediation path: NIST has standardized PQC algorithms; CISA and NSA have published migration guidance. Organizations must inventory legacy encryption, prioritize systems protecting sensitive long-term data (state secrets, financial records, healthcare), and stage PQC deployment.

• Sourcing is limited: The CSO Online article is truncated in the provided material; specific targets, sectors, or recent incidents are not enumerated here. This alert flags the threat landscape rather than a specific breach or campaign.

IMPACT:

Organizations using current symmetric and asymmetric encryption for data expected to remain sensitive 5+ years hence. Highest impact: government agencies, critical infrastructure, financial services, healthcare, defense contractors, telecom. Any entity holding encrypted data classified or commercially sensitive faces retroactive decryption risk if quantum capability matures before PQC is deployed.

RECOMMENDED ACTIONS:

1. Immediate: Audit encryption inventory—identify systems, data, and algorithms in use. Flag data with long confidentiality requirements (10+ years).
2. This quarter: Draft PQC transition roadmap; engage leadership on budget/timeline; begin pilot PQC implementations on non-critical systems.
3. Ongoing: Monitor NIST, CISA, NSA PQC guidance updates; subscribe to threat-landscape reporting from CSO Online and similar sources.

SOURCES:

CSO Online: “Getting ahead of ‘harvest-now-decrypt-later’: Post-quantum cryptography planning.” (September 2026)
Related: NIST Post-Quantum Cryptography Standardization Project; CISA PQC Migration Guidance.

STATUS: This alert synthesizes threat-landscape reporting, not an active incident. Monitor for sector-specific HNDlater campaigns or organizational breach disclosures mentioning quantum-era concerns.

Recent high-severity events at publish time: