Your most serious data breach may have already happened, you just haven’t felt the impact yet.
Encrypted data stolen years ago doesn’t lose its value. As quantum capabilities advance, that data could become readable, turning historic (and forgotten) incidents into future liabilities.
Chris Harris is the EMEA Technical Associate Vice President of Data Security Products at Thales.
The threats posed by quantum computing are still widely spoken about in a futuristic, hypothetical context. This assumption is already outdated. The risks are not tied to a distant breakthrough, but rooted in how data is being exposed and handled today.
What makes quantum different from previous cybersecurity threats is not just its power, but how it fundamentally changed the lifecycle of a breach. The data stolen today no longer needs to be decrypted today.
It can be collected, stored, and unlocked years later, turning what appears to be a contained incident into a delayed and potentially far more damaging exposure in the future.
Traditional security thinking assumes that once a breach is identified and contained, the risk declines over time. Quantum reverses that logic. In some cases, the real impact of a breach may only emerge years after the event itself.
The rise of delayed breaches
Quantum introduces a different kind of exposure: “harvest now, decrypt later” (HNDL). Attackers do not need to break encryption today. They need access to data that will still be valuable in the future.
It’s no surprise, then, that 61% of organizations rank this as their top quantum-related risk, according to the Thales Data Threat Report. That reflects a shift in how organizations are thinking about breach impact. Data theft is no longer the end of the story; it’s the beginning of a much longer exposure window.
For organizations handling long-life data, the implications are significant. Intellectual property, financial records, customer data, and strategic communications often retain value for years, even decades. If that data is compromised today, it may not be immediately usable, but its long term value – and risk – remains intact.
And this risk is far from theoretical. 67% of organizations already report rising credential theft, a sign that attackers are already gaining access to sensitive data at scale. This is not driven by quantum computing, but it expands the pool of data that could be decrypted in the future.
By the time quantum capabilities mature, some of that data may become readable, long after the original breach has been forgotten, investigated, and closed. This creates a long-tail risk that many organizations still underestimate.
You can’t secure what you can’t see
At the same time, many organizations are struggling with a more immediate weakness: limited visibility into their data. Only 34% of organizations report full knowledge of where their data is stored, and less than half of sensitive cloud data is encrypted.
These are not marginal gaps. They represent systemic exposure on how data is governed and protected.
Without a clear view of what data exists, where it resides, and how it is secured, it becomes difficult to assess exposure – not just today, but over the lifespan of that data.
Encryption is often treated as a safety net, but it is not future-proof by default. Its effectiveness depends entirely on the strength and longevity of the underlying cryptography and how long the data it protects needs to remain confidential.
If organizations do not understand which cryptographic standards are in use and where they are applied, they cannot assess whether their protections will hold.
The challenge is straightforward: you can’t protect what you can’t see – and in a quantum context, that visibility gap becomes a strategic risk.
Experimentation does not equal readiness
There are encouraging signs of progress. Nearly six in ten organizations are already experimenting with post-quantum cryptography, indicating that awareness is translating into early action.
However, experimentation alone is not enough. Cryptography is deeply embedded across modern IT environments, from legacy systems to cloud-native applications, often without central oversight. Strengthening it requires understanding where cryptography exists, how it is used, and how long the data it protects needs to remain secure.
Without that foundation, organizations risk focusing efforts on the wrong systems or securing data for the wrong timeframe, leaving high-value assets exposed.
Real readiness requires building crypto-agility: the ability to adapt cryptographic approaches as standards evolve. It also means modernizing key management and mapping cryptographic dependencies across increasingly complex, distributed environments.
Without these, even proactive efforts will fall short.
The window to act is wide open
Quantum risk is not a distant scenario. It is already shaping the data breach fallout of tomorrow, whether organizations recognize it or not. Once sensitive data is exposed, it cannot be “re-secured” years later when quantum capabilities emerge. The window to act is defined by how long that data remains valuable, not by when quantum computing reaches maturity.
Leaders need to move beyond experimentation and take a hard look at where their data lives, how it’s protected, and how long it needs to remain secure. That means identifying cryptographic dependencies, prioritizing high-value data, and embedding crypto-agility into the fabric of their environments.
Because in the quantum era, the most significant breach may not be the one you detect today. It’s the one that has already happened and is quietly waiting to be understood.
We’ve featured the best endpoint protection software.
This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.
The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit
