10/09/2026
Threat actors can collect your encrypted data today and retain it for future decryption if quantum computing eventually makes that possible.
This attack has a name: Harvest Now, Decrypt Later (HNDL). It requires no quantum computer todayāonly the ability to collect and store encrypted information. The Canadian Centre for Cyber Security warns about this threat and recommends that organizations begin preparing for the transition to post-quantum cryptography.
The Thales 2026 Data Threat Report found that 61% of respondents identified HNDL as their top quantum-related concern. Canada's federal PQC roadmap sets migration milestones for high-priority government systems by the end of 2031 and remaining systems by the end of 2035. NIST finalized its initial post-quantum cryptography standards in August 2024, while OSFI published quantum-readiness guidance for federally regulated financial institutions in March 2026.
The twenty-third edition of Canadian Cyber Risk Insights examines what HNDL means for Canadian organizations, where Canada stands on the post-quantum cryptography transition, and how a practical five-phase migration framework can help organizations begin preparing now.
The CCCS document to start with is ITSAP.00.017: Preparing Your Organization for the Quantum Threat to Cryptography. It is publicly available and provides a practical starting point for organizations of different sizes and sectors.
The question is not simply when quantum computers will arrive. It is whether your organization understands which data needs protection, what cryptography protects it, and how long that protection must last.
Post-quantum cryptography is an increasingly important security priority, but many organizations are still ahead on awareness and behind on implementation. The threat does not begin when quantum computers arrive.