What is “harvest now, decrypt later” — and what data is at risk today?

State as of: October 30, 2026.

As of October 30, 2026, the public record holds 0 RSA-2048 keys broken by a quantum computer and 0 breaches attributed to a quantum attack (both re-verified today by Rosetta Quantum) — and yet “harvest now, decrypt later” (HNDL) is the reason the main security agencies tell you not to wait for that first break: encrypted traffic captured today can be stored until a machine capable of decrypting it exists. Whether your data is at risk is arithmetic, not mood. If its confidentiality lifetime plus your migration time will exceed the time left until a cryptographically relevant quantum computer, the exposure has already begun (Mosca, IACR ePrint 2015/1075). This page defines the term, shows the arithmetic, and puts every deadline next to its source.

What does “harvest now, decrypt later” actually mean?

It means recording encrypted data today — without being able to read it — and storing it until a future machine can decrypt it. The interceptor does not need a quantum computer now; it needs storage and patience. The joint CISA/NSA/NIST quantum-readiness factsheet (August 21, 2023) names the pattern explicitly: threat actors “could be targeting data today” in what it calls “harvest now, decrypt later operations,” and flags it as the planning assumption for any data with a long secrecy lifetime.

Two things follow from the definition. First, HNDL is a risk category, not an accusation: the public record contains no evidenced attribution of a specific harvesting campaign to a specific actor, and Rosetta Quantum will not name one without a linked source. Second, the loss event for long-lived data is the capture, not the future break — which is why the deadline for defenders is earlier than any Q-Day estimate.

Has a single harvested file actually been decrypted?

No — the score today is 0 and 0. As of October 30, 2026, Rosetta Quantum’s documentary review (re-run for this piece) finds 0 RSA-2048 or ECC-256 keys broken by a quantum computer in the public record, and 0 public breaches attributed to a quantum attack. Known incidents at quantum companies themselves (for example, the August 2026 Quantinuum data breach) were conventional, not quantum. Those zeros are first-class data of this channel and will be re-verified in every edition of the board below.

The zeros do not close the question, because the two halves of HNDL live in different decades: bulk interception and storage are present-day, documented capabilities of well-resourced actors, while the decryption half is a bet on future hardware. That asymmetry — cheap to collect now, maybe readable later — is the entire mechanism, and it is also why fear with no number attached is the wrong response. The right response is the inequality below.

What is Mosca’s inequality — and how do you compute your own deadline?

The test is: if x + y > z, you will have a problem. In the formulation popularized by Michele Mosca (IACR ePrint 2015/1075, November 2015): x is how long your data must stay confidential, y is how long your migration to post-quantum cryptography will take, and z is how long until a cryptographically relevant quantum computer (CRQC) exists. If x + y exceeds z, data captured near the end of your migration will still be sensitive when the machine arrives. In that 2015 paper Mosca put his own estimate on record: “a 1/2 chance of breaking RSA-2048 by 2031.”

What does z look like in 2026? The latest Global Risk Institute Quantum Threat Timeline report (published March 9, 2026; 26 experts surveyed) will not give you a date, but it gives distributions: 13 of 26 experts (50%) put the probability of a CRQC within 10 years at about 50% or higher; 18 of 26 (69%) say the same for 15 years; and 92% of respondents put the 20-year probability at 50% or higher. Rosetta Quantum’s own position, RQ-PRED-QDAY-001 (sealed October 9, 2026), is a floor of 2031 and a window of 2033–2039 — and it is a sealed, refutable judgment with a scoring rule, not a measurement.

A worked example, with the reader’s numbers: a 7-year retention obligation (x = 7, the US SOX audit-records floor) plus a 5-year migration (y = 5, roughly the NCSC’s phased 2028→2035 guidance for a large estate) requires z > 12 years — safe only if no CRQC exists before 2038. Against the GRI distribution above (69% of experts put ≥50% odds inside 15 years), that is not a bet a board signs off without a plan.

What data is actually at risk today — and what mostly is not?

The exposure class is data whose confidentiality must outlive the early 2030s. Regulated retention periods are a useful floor for x, because they are documented and dated — the real confidentiality need is often longer. The table reads: if this class of data is captured today, when does its mandated lifetime end?

Read against the clocks: even the shortest row (6 years) runs past the NIST 2030 deprecation date, and the long rows outlive every deadline on the ladder above. On the other side: data whose content stops mattering in weeks or months — ephemeral session traffic, short-lived operational chatter — mostly is not HNDL-exposed, because its x is smaller than any plausible z. And exposure requires capture: ciphertext that never crosses a channel an adversary can record, and is never exfiltrated in a breach, has nothing to be harvested from.

Why isn’t your deadline Q-Day?

Because for long-lived data the loss happens at capture time, and that is exactly how the regulators who publish dates have reasoned. NIST IR 8547 (final version published October 27, 2026) will deprecate RSA and ECC after 2030 and disallow them after 2035. US Executive Order 14412 with OMB M-26-15 (June 2026) will require post-quantum key exchange in federal high-value assets by December 31, 2030 and post-quantum signatures by December 31, 2031. The EU’s NIS Cooperation Group roadmap (June 2025) will require member states to complete inventories by the end of 2026 and protect high-risk use cases by the end of 2030. The UK NCSC timeline (March 2025) runs discovery to 2028, high-priority migration to 2031, completion to 2035. None of those bodies claims to know when a CRQC will arrive; all of them set dates roughly a decade earlier than their own planning horizons, and HNDL is the stated reason (the house mapped that reasoning when the cryptographic clock was first published). Rosetta’s Q-Day window (2033–2039) opens after the early deadlines (2028–2031) but overlaps the 2035 ones — and the deadlines are still rational, because they price the capture, not the break.

What should a security team do with this arithmetic?

Four moves, none of which requires buying anything. First, inventory: the CISA/NSA/NIST factsheet’s first substantive step is a cryptographic inventory — you cannot compute x + y for systems you have not found (the same step every regulator with a deadline puts first, as Rosetta mapped for Latin America). Second, classify your data by confidentiality lifetime: that is your x, and the table above shows how to anchor it in documented retention rules. Third, measure what already negotiates PQC without you: at the Cloudflare edge, ≈67% of human HTTPS requests already used post-quantum key agreement as of April 15, 2026 (Cloudflare Radar), and 12.8% of scanned origin servers supported it by September 8, 2026 (Cloudflare) — browser-to-edge is largely done, which means your remaining exposure is concentrated in your own links, VPNs, and stored archives. Fourth, sequence the migration by x, longest-lived data first; that ordering is the entire practical content of the inequality.

PQC Board — status as of 2026-10-30

The living indicator board of this channel: latest reading per indicator, each with its own date and source. History is append-only; a material change in any row is news.

What we don’t know

Whether anyone is actually running HNDL collection at scale: it is asserted as a planning assumption by CISA, NSA and NIST, but no public, evidenced attribution of a specific campaign exists — we treat HNDL as a capability-based category, not a documented practice of a named actor. When, or whether, a CRQC will arrive: expert polls are structured judgment, our own window is a sealed bet, and neither is a measurement. How much captured ciphertext actually survives in adversary storage: the economics of interception archives are not public. And whether the ≈67% Cloudflare share has moved since April 2026: no fresher primary reading surfaced in today’s check, so the board keeps the dated value rather than inventing a newer one.

Rosetta Quantum publishes verdicts with raw, reproducible data. This is educational content, not a product claim, and nothing here is a recommendation to buy any product. The Q-Day window cited is Rosetta’s own sealed, refutable judgment (RQ-PRED-QDAY-001), not a measurement.