Your Encrypted Data Is Already Gone. Here Is What That Actually Means.

Most security conversations assume a shape: the attack happens, you detect it, you respond. There is a window in which damage can be contained.

Harvest Now, Decrypt Later has no such window. The attack already happened, quietly, with no alert and no indicator of compromise. The damage does not materialize until a cryptographically relevant quantum computer exists.

This is not speculative.

The US National Security Agency stated in a 2022 advisory that adversaries are already harvesting encrypted data with the intention of decrypting it once sufficiently powerful quantum computers become available. It is an active collection operation, invisible by design.

Be Precise About What Is Actually at Risk

Most coverage of this threat is too loose to act on, so start here.

Shor's algorithm attacks asymmetric cryptography. It factors the composite modulus RSA is built on into its two large prime factors, and it solves the discrete logarithm problem underpinning elliptic curve cryptography. RSA, ECC, Diffie-Hellman, the key exchange in every TLS session, and the signatures holding up PKI all fail together.

Symmetric cryptography is in a different position. The only meaningful quantum attack on AES is Grover's algorithm, and it provides a quadratic speedup, effectively halving key strength. AES-256 retains roughly 128 bits against a quantum adversary.

That is a reason to prefer long keys, not a reason to panic.

So, the honest threat model is narrower and more actionable than the headline.

Harvest Now, Decrypt Later is overwhelmingly a problem for data whose confidentiality depends on the asymmetric layer, and for long-lived ciphertext whose symmetric keys may eventually leak through means having nothing to do with quantum computing.

Where the Timeline Sits

The seventh Quantum Threat Timeline Report, published March 9, 2026 by the Global Risk Institute and drawing on 26 experts, assessed a cryptographically relevant quantum computer as quite possible within ten years and likely within fifteen.

Google warned in March 2026 that quantum computers may be able to break some encrypted systems by 2029, materially more aggressive than most prior estimates.

Cloudflare has set a 2029 migration deadline on that basis. No such machine exists today.

The implication does not depend on picking a date. If you hold records that must stay confidential for ten years, and a capable machine is plausible within ten to fifteen, records leaving your organization today are inside the exposure window.

That is Mosca's inequality, and it resolves without anyone being right about the year.

Post-Quantum Cryptography Is Necessary and Not Sufficient

NIST finalized its first post-quantum standards in 2024. Migration is underway and should accelerate.

PQC solves the forward problem. It does nothing about ciphertext already sitting in an adversary's storage. Migrating tomorrow does not reach the API traffic captured in 2023.

For most large organizations some portion of that harvest has already happened, and the question is not how to prevent it. It is what the adversary finds when they finally open it.

Encryption hides data. Tokenization replaces it. An intercepted ciphertext contains the original value, hidden. An intercepted token contains nothing. It is a reference to a value held elsewhere.

The Structural Difference

Encryption transforms a value using an algorithm and a key. The ciphertext is a mathematical derivative of the plaintext, and the relationship is deterministic and reversible.

That is the point of encryption.

Against a patient adversary it is also the exposure, because the ciphertext travels with the value locked inside it.

A vaulted token is not a transformation. It is a randomly generated reference to a value stored separately. No algorithm applied to the token yields the original, because the token does not encode the original.

An adversary who harvests tokenized data holds random strings.

Future compute converts them into nothing, because there is no relationship to compute against.

Reversal requires live, authenticated access to the vault. That leaves logs and can be alerted on. It cannot be performed retroactively against a stolen backup.

The Part Most Vendors Leave Out

Tokenization does not make you quantum-proof, and the claim that it does should make you suspicious of whoever is making it.

Traffic carrying sensitive values to your tokenization layer relies on classical key exchange, and is harvestable exactly as anything else is. Your vault, key management, and authentication all depend on cryptography that needs to migrate.

No architecture exempts you from the PQC roadmap.

Format-preserving encryption sits in an interesting middle position that deserves saying out loud, including by those of us who sell it.

Because FPE is a mode of operation on AES, it inherits AES's quantum durability. FPE on AES-256 is not what Shor's breaks. Its exposure is key compromise and, in small domains, published cryptanalysis of specific modes.

Those are real risks with real mitigations, and they have nothing to do with Q-Day. Anyone using quantum fear to sell against FPE is arguing badly.

What tokenization does is reduce the population of harvestable records.

Instead of sensitive values living in your application database, your analytics platform, your warehouse, your backups, and three vendors' environments, they live in one place. s

Everything else in circulation is placeholders. Exposure goes from distributed and unmeasurable to bounded and known.

That is a smaller claim than quantum-proof. It is also true, which matters more.

The Question Worth Sitting With

Every organization that has transmitted sensitive data under classical encryption faces a question with no comfortable answer: how much has already been taken?

Nobody knows.

HNDL collection is passive and leaves no forensic trace. No alert, no anomaly, no log entry. You cannot audit your way to an answer.

That uncertainty is the argument for narrowing the target now. You cannot un-take what is gone. You can decide whether the next several years of records are worth the storage an adversary is paying to keep them.

Encrypted does not mean safe. It means not yet broken. The difference is a schedule, and you do not control it.