Harvest Now, Decrypt Later: Why Enterprises Must Prepare Now

The Rise of Harvest Now, Decrypt Later and The Quantum Risk No Business Can Ignore

In Dune, Frank Herbert’s eponymous sci-fi work, there is a phrase that is often repeated – ‘fear is the mind killer’. We can juxtapose this saying with the cybersecurity landscape, as the fear of not being future-ready is what keeps CISOs up at night. The very thought that a cybersecurity strategy, created and implemented with great effort, won’t be able to keep every evolving and increasingly sophisticated threat at bay is disconcerting.

One such threat is HNDL or ‘Harvest-Now, Decrypt-Later’.

Today, HNDL looks straight out of the realms of science fiction. The premise is simple. Imagine cybercriminals hacking into your organization’s network and stealing vast amounts of important information. This happens silently, under the radar. Your cybersecurity framework might or might not flag this transgression.

Even if this security incident is flagged, subsequent investigation reveals there is no immediate danger.  Asymmetric encryption algorithms, such as RSA, Diffie-Hellman, and Elliptic Curve Cryptography (ECC), provide protection for your data. This data is also not available for sale on the dark web.

Unfortunately for you, attackers are patiently waiting for Q-Day, the day when quantum computing becomes accessible to them. This will allow them to break your encryption and maliciously leverage stolen data.

Attackers using HNDL tactics don’t just look at what your organization is worth today. They can deliberately target firms that have the potential to scale into major players in the coming years. By stealing and stockpiling sensitive data now, they hope to unlock and monetize it later; timing their payday to coincide with your future growth and market value.

What is Harvest-Now, Decrypt-Later?

HNDL, or Harvest Now Decrypt Later, is a data breach strategy with a long gestation period. Cyber criminals are playing the long game when they choose to intercept, steal and store organizational data. They steal data not because they can immediately decrypt it, but rather because they anticipate that quantum computing will become a reality, enabling them to break existing cryptography.

The thinking behind HNDL is simple. Q-Day isn’t too far into the horizon. Therefore, it makes sense to steal data that has long-term value. In fact, there is a case to be made that data can also increase in value. This is data with a long shelf life. HNDL only works if the data retains (or increases) strategic value many years down the road.

Why Enterprises Should be Worried About HNDL?

HNDL is a cause for concern, and you should be worried because the arrival of quantum computing is expected within the next few years. For example, by 2029, IBM will deliver IBM Quantum Starling. While this does not mean quantum decryption will be available immediately, threat actors have already started data harvesting.

We have also observed that the mainstreaming of new technologies is accelerating over time. When quantum technology finally makes its appearance, its adoption will be accelerated across domains.

A Capgemini report finds that roughly two-thirds of organizations (65%) are concerned about the growing threat of ‘harvest-now, decrypt-later’ attacks. Among early adopters, one in six anticipate that ‘Q-day’ will arrive within the next five years, while nearly six in ten expect it within the coming decade.

If the C-Suite in your organization is not already discussing quantum readiness, the conversation must happen immediately. HNDL is a clear risk, and for any organization, its most securely encrypted asset can be the victim of a data breach tomorrow. You need to start preparing for a post-quantum computing world today.

Blame it on Quantum Computing

When we refer to quantum computing, we are talking about quantum computers, which represent the next advancement in computing. These are supercomputing platforms that harness the laws of quantum mechanics to reduce the time taken to solve complex problems. This means they will dramatically reduce data processing and algorithm run time to help break advanced encryption quickly.

Today’s computers, with their current computing speed, struggle to break existing encryption models like RSA and ECC. However, powerful quantum processors can solve the mathematical problems that underpin these encryption methods much faster. They can run through a range of potential solutions to a problem in a highly accelerated manner, thus helping to break encryption faster.

Two quantum algorithms, namely Shor’s and Grover’s algorithms, pose a significant threat to cryptography and can fuel HNDL. Shor’s algorithm factors large integers, which underpins a range of modern cryptographic systems. Grover’s algorithm, on the other hand, helps quantum computers search through unsorted data at a hugely faster rate than traditional computers.  Unlike Shor’s algorithm, which can break key encryption, Grover’s algorithm significantly reduces the strength of symmetric key encryption, such as AES.

Types of Data Most at Risk with HNDL

We’ve discussed long-life data and why it is the prime target of HNDL attacks. Longevity doesn’t simply mean information that could be misused a few years after it is stolen. It refers to data that can remain exploitable even decades after it is eventually decrypted. That’s why, when conducting a quantum risk assessment, organizations should evaluate the significance of their information through the lens of decades, not just years.

• Healthcare records can stand the test of time. A patient’s history, genetic profile, or the results of a long-running clinical trial remain highly exploitable for many years.
• Classified intelligence, defense communications, or citizen registries can be agents of chaos in the wrong hands. When such records are stolen and later decrypted, the fallout can be the erosion of national security.
• For businesses, intellectual property sits at the core of their competitive edge. Blueprints, source code, trade secrets, or years of research and development (R&D) may still carry immense value long after they were first created.
• Biometric identifiers belong in a category of their own. Unlike passwords, a fingerprint or an iris scan can’t be reset. Once copied, they become permanent keys that enable attackers to re-enter systems repeatedly.
• Contracts, merger documents, transaction histories and audit trails often stretch across decades, and if exposed, they can fuel insider trading, fraudulent schemes or costly regulatory penalties.

Why Enterprises Should Prepare for a Post-HNDL World?

Forget about Harvest-now, decrypt-later attacks; the scale of data breaches is increasing as you read this, with billions of credentials being exposed with just one breach. This gives you an idea about the magnitude of the problem when quantum computers enter the picture.

We are also witnessing the emergence of government guidance and laws on post-quantum cryptography. The US Government Quantum Cybersecurity Preparedness Act is a case in point. It mandates federal agencies to prepare for the transition to PQC. NIST (National Institute of Standards and Technology) has already finalized a list of post-quantum encryption standards that companies can follow.

Across the pond, the European Union has released a roadmap recommending that member states transition to quantum-safe encryption. The primary objective here is not to wait for Q-Day to initiate the migration process.

For enterprises, the shift won’t be easy. The scale of transformation is going to be immense. Migration timelines will be long drawn out and will be a multi-year exercise. We refer to a multitude of custom applications that will be utilized to replace cryptographic libraries, reissue certificates and perform other similar tasks.

By starting their journey to post-quantum safety now, organizations can be well-prepared when quantum computing becomes mainstream. More importantly, by taking a proactive stance against HNDL now, you are signaling to key stakeholders that you are serious about building a future-ready cybersecurity posture.

The Mitigation Plan

A Change of Mindset

Transitioning to a post-quantum security paradigm necessitates a strategic shift in thinking. Don’t treat this as a checkbox exercise; instead, look at it from the perspective of building a future-ready security framework that will evolve over the years as threats and technologies take a more concrete shape.

Know the Extent of Risk

Develop a granular map of all cryptographic inventory, specifically identifying where cryptography is used and the type of data it protects. Each of these assets needs to be ranked according to its criticality to your organization, which helps prioritize its migration and ensures a more effective approach.

Make a Business Case for Quantum Risk

A post-quantum world is not a case of ‘if’, but ‘when’, and that when is sooner than you think. As a CISO, you must start creating a risk profile for this world to build a strong business case for your mitigation plan. Discussion shouldn’t be just around the IT security teams but must be taken to the boardroom. This ensures that the budget allocation is in line with the risk.

Don’t Go Big Immediately

Considering the nature of the threat, there will be an inclination to take big steps from the get-go. However, you must identify pilot projects and controlled experiments where you can get a better understanding of the implementations. Successful pilots can be scaled up quickly without fear of failure.

Prepare for Quick Cryptographic Updates

NIST has already finalized a set of encryption algorithms. But this is not the end of it. New standards and algorithms will continue to emerge, necessitating their adoption.  Be prepared to swap existing cryptographic algorithms without a large-scale systemic overhaul.

Final Thoughts

The entire approach revolves around considering migration or mitigation as a dynamic scenario that requires your organization to be agile, flexible, and up-to-date with the latest developments in Post-Quantum Cryptography. This will help you put the best foot forward when it comes to addressing HNDL. In an era where reputation is as valuable as revenue, being quantum-ready signals to customers, partners, and regulators that your brand is built to last.