The Lock Is Already Being Picked

Every email you send. Every bank transaction. Every classified government file transmitted over a network. All of it is protected by encryption math that a sufficiently powerful quantum computer will be able to crack like an eggshell.

According to BCG, that breaking point arrives sometime around 2035.

The Threat Nobody Is Talking About Loudly Enough

Mainstream coverage keeps burying the crucial detail: the attack may already be underway.

Adversaries, including state-sponsored actors, are collecting encrypted government and corporate data today through what's called "Harvest Now, Decrypt Later" — HNDL for short. They can't read it yet. They're waiting until quantum computers are powerful enough to do the decryption. Then they open the vault.

Palo Alto Networks' Unit 42 threat research team puts it plainly: data theft is already moving faster than most organizations realize. The quantum computer doesn't need to exist yet for the attack to be in motion.

Dr. Tim Robinson, writing for Federal News Network in April 2026, makes the federal exposure explicit. He notes that agencies must "assume that adversaries may already possess encrypted government data and are waiting until quantum computers are powerful enough to decrypt it." That's the working assumption of serious security professionals right now.

What Breaks When Quantum Arrives

The encryption standards at risk are the ones running the entire internet. RSA. AES. Elliptic curve cryptography (ECC). These aren't obscure technical footnotes — they are the mathematical foundation of every secure online transaction on Earth.

BCG reports that connected devices worldwide are expected to surpass 40 billion by 2030, and e-commerce will account for roughly 4% of global GDP by 2029. All of that runs on encryption that quantum computing threatens to make worthless.

As BCG puts it: quantum decryption could "literally break the internet."

The Federal Government Has a Legacy Problem

Federal agencies face a compounding headache. Dr. Robinson points out that many government systems were designed six or seven years ago — built to meet the security requirements of that era, with zero consideration for quantum threats. Those systems are now baked into networks and hardcoded with encryption that can't be easily swapped out.

This is the "crypto-agility" problem. When encryption is hardcoded into software, updating it isn't a patch job. It means rewriting software and redesigning networks from scratch. The cost — in dollars and mission risk — is enormous.

Government agencies have deferred modernization for years. The bill comes due now.

NIST Has Acted — But Migration Is Slow

The National Institute of Standards and Technology finalized its post-quantum cryptography (PQC) standards — FIPS 203, 204, and 205 — establishing the new baseline for quantum-resistant algorithms.

Knowing the standard exists and actually migrating to it are two completely different things. Palo Alto Networks describes the migration challenge as one of the most significant IT transitions organizations will face. It's not plug-and-play. It requires auditing every system that uses cryptography, prioritizing the most critical ones, and rebuilding with modular "crypto-agile" architectures that can adapt as standards evolve.

BCG's analysts — Jean-François Bobier, Clément Fouilloux, Vanessa Lyon, and their co-authors — estimate the transition is expensive and time-consuming. They recommend companies start now, classify critical systems, and build in flexibility.

What Mainstream Coverage Gets Wrong

Most tech media treats this as a future problem. "Quantum computers aren't powerful enough yet, so relax." That framing is wrong.

The HNDL threat means the timeline for harm is not 2035. It's today. Data being stolen right now will be decrypted the moment quantum hardware crosses the threshold. Sensitive government communications, financial records, intellectual property — all of it has a shelf life tied to quantum progress, not current security posture.

Another gap in coverage: this isn't equally distributed risk. Banks, defense contractors, federal agencies, and healthcare systems hold the data adversaries most want. Those organizations need to move first and fastest.

What This Means for Regular People

Your bank account. Your medical records. Your Social Security data sitting in some government database. All of it is protected right now by encryption that has an expiration date stamped on it — approximately 2035, possibly sooner.

If the agencies and companies holding your most sensitive information don't complete the transition to post-quantum encryption before that date, the data is exposed.

The federal government has been slow-walking IT modernization for decades. The private sector has been even worse at treating long-horizon security threats as urgent. Both are running out of runway.