Q-day is the name given to the moment a quantum computer can break the public-key cryptography protecting most of the world's data. Nobody can date it precisely. That uncertainty is often treated as a reason to wait, which gets the risk exactly backwards, because the data that will be exposed on q-day is being stolen now.
The incident register for 1 August to 12 September 2026 makes the point concrete. In six weeks, the disclosed losses included more than 150 million identity document images, genetic and laboratory data on millions of people, sealed and confidential court records, and bank and Social Security identifiers. None of those expire. All of them keep their value for as long as the person, the case or the account exists.
Contents
- What q-day actually means
- Harvest now, decrypt later
- The 2026 thefts with the longest shelf life
- How long does your data stay sensitive?
- The deadlines that already exist
- What a harvested archive is worth later
- Why "wait for q-day" fails as a strategy
- What to do before q-day arrives
- Frequently asked questions
Key Takeaways
- Q-day is the point at which a cryptographically relevant quantum computer can break RSA and elliptic-curve cryptography.
- Harvest now, decrypt later means encrypted traffic and stolen archives are being collected today to be read after q-day.
- The six-week register included identity documents, genetic data and sealed court files, categories with decade-long sensitivity.
- NIST's draft transition guidance deprecates 112-bit RSA and ECDSA after 2030 and disallows them after 2035.
- The migration is a multi-year engineering program, so the useful question is what your data will be worth when it completes.
What q-day actually means
Public-key cryptography protects almost everything: web sessions, VPNs, software updates, payment traffic, machine identities. Its security rests on mathematical problems that classical computers cannot solve at scale. A sufficiently capable quantum computer can, which is why NIST has standardized replacement algorithms through its post-quantum cryptography project and published the first finalized standards.
Q-day is shorthand for the arrival of that capability. Our explainer on what a cryptographically relevant quantum computer is covers the technical threshold, and Shor's algorithm explains the mathematics.
The date is genuinely unknown. What is not unknown is the direction of travel, and the fact that standards bodies have already set transition deadlines.
Harvest now, decrypt later
Harvest now, decrypt later is the strategy of collecting encrypted data today and storing it until it can be decrypted. It requires no breakthrough on the attacker's part, only patience and storage, both of which are cheap.
Two supplies feed it. The first is intercepted traffic: encrypted sessions captured in transit. The second, visible in every breach register, is stolen archives: databases and file stores taken in plaintext or encrypted form and held indefinitely.
The second supply is the one enterprises underestimate. An attacker who exfiltrates an encrypted backup today does not need to break it today.
Key Insight
Every breach is dated twice: the day it happened, and the day the stolen data can finally be read. For anything encrypted with today's public-key cryptography, the second date has not arrived yet.
The 2026 thefts with the longest shelf life
Four categories from the six-week register illustrate the point.
Identity documents. Krebs on Security reported a service selling access to scans of driver's licenses and identity documents for more than 150 million people, and TechCrunch reported the provider's confirmation of a breach. A driver's license number changes rarely. A face on an identity document does not change at all.
Genetic and laboratory data. A genetics laboratory disclosed an incident affecting about 2.8 million people, with genetic, laboratory, health and identity data potentially exposed. Genetic data is not only permanent for the individual; it carries information about relatives who were never customers.
Sealed and confidential court records. The court platform incident involved records that could include sealed or confidential material, alongside names, Social Security numbers and medical information. Sealing is a legal protection, not a cryptographic one.
Financial identifiers. A consumer finance company disclosed an incident affecting more than 734,000 people, with bank, routing, Social Security and tax identifiers exposed. Account numbers can be changed; Social Security numbers effectively cannot.
How long does your data stay sensitive?
Data types vary widely in how long they stay dangerous. Session tokens and short-lived credentials stay sensitive for hours to days, so their exposure on q-day is minimal. Commercial pricing and negotiations stay sensitive for one to three years, giving low to moderate exposure. Health and insurance records, financial identifiers and tax data, and engineering designs or long-lived intellectual property all stay sensitive for decades, giving high exposure. Identity documents and biometrics stay sensitive for a lifetime, giving very high exposure. Genetic data stays sensitive for a lifetime and beyond, because it also implicates relatives who were never customers, giving very high exposure. And sealed legal proceedings and source identities stay sensitive indefinitely, giving severe exposure.
If your organization holds anything in the bottom half of that list, harvest now, decrypt later is a present-tense risk rather than a forecast.
The deadlines that already exist
Even without a date for q-day, the compliance clock is running. NIST's draft transition guidance, NIST IR 8547, sets out the schedule for classical algorithms: RSA and ECDSA at the 112-bit security level are deprecated after 2030 and disallowed after 2035, with the document noting the need to migrate to quantum-resistant algorithms in that timeframe.
Alongside it, NSA's CNSA 2.0 suite sets its own transition requirements for national security systems and the vendors that serve them, and several national regulators have issued migration expectations. Our guide to quantum computing and compliance covers how these intersect with GDPR, HIPAA, PCI and DORA.
Migration is not a switch. It requires knowing where cryptography is used, which is why a cryptographic bill of materials is the usual starting point, and it typically runs for years across cloud, applications, devices and suppliers.
What a harvested archive is worth later
It helps to think in terms of the attacker's balance sheet. Storing an encrypted archive costs almost nothing. The only question is whether the contents will still be worth reading when decryption becomes possible. For a pricing spreadsheet, the answer is no. For a set of identity documents, a genetic database or a sealed case file, the answer is clearly yes, and the wait costs the attacker nothing but time.
This is why the q-day conversation belongs with data retention rather than with cryptography alone. Every archive kept for compliance is also an archive that can be stolen and stored, and the longer the retention period, the more attractive the target becomes.
Why "wait for q-day" fails as a strategy
The waiting argument assumes two things: that you will get advance notice, and that migration is quick. Neither holds.
Advance notice is unlikely because the capability, if developed by a nation-state, is an intelligence asset and will not be announced. Migration is slow because cryptography is embedded in applications, libraries, devices, certificates and supplier integrations that few organizations have fully inventoried.
The arithmetic used to judge this is the Mosca inequality: if the time your data must stay secret, plus the time your migration takes, exceeds the time until q-day, you are already late. We cover it in the Mosca inequality.
Key Insight
You do not need to predict q-day. You need to know how long your data must stay secret and how long your migration will take. If those two numbers add up to more than the shortest credible timeline, waiting has already cost you.
What to do before q-day arrives
- Classify by shelf life, not by sensitivity label. Ask how long each dataset must stay confidential, then prioritize anything measured in decades.
- Inventory cryptography. Know which algorithms, key lengths and certificates are in use, and where.
- Protect data in transit first. Encrypted sessions are the primary harvest supply.
- Encrypt archives and backups with quantum-safe algorithms. These are the stolen-archive supply.
- Put quantum-safe encryption on supplier connections too. Third-party integrations carry the same long-lived data.
- Prefer crypto-agility. Design so algorithms can be replaced without re-architecting, as argued in crypto agility as a business capability.
The sequencing matters more than the speed. Organizations that start with an inventory usually discover that a small number of systems carry most of the long-life data, and that several of them are supplier integrations rather than internal applications. Those become the first candidates for quantum-safe protection, well before a general migration programme reaches them.
This is where the two attackers meet in one cybersecurity decision. Conux applies quantum-safe encryption at the gateway every connection already passes through, so protection arrives with the deployment rather than with a per-application migration project, and the same gateway blocks the autonomous attacks happening today. One deployment, both attackers, nothing ripped out.
To map your long-life data against the transition deadlines, talk to our team.
