Your Encrypted Data is Already Being Stolen: The Alarming Reality of Cybersecurity Threats

Post Views: 143

Financial Institutions Face Imminent Quantum Risk from Encrypted Data Harvesting

A common misconception among financial leaders is that quantum threats to encryption will materialize suddenly, on a single future date, when quantum computers become capable of cracking current encryption methods. However, according to Ronit Ghose, Global Head of the Future of Finance at Citi Institute, this mindset is already putting financial institutions at risk. The reality is that adversaries can harvest encrypted data today and decrypt it later, creating long-term exposure for banks handling sensitive identity and transaction data.

Understanding the Quantum Risk Misconception

Ghose argues that quantum risk is both an immediate confidentiality problem and a systemic trust crisis. The misconception that quantum risk is a single future date problem persists for three reasons. Firstly, the concept of a single “Q-day” is easy to communicate, but it hides the continuous nature of risk and the fact that migration programs take years to implement. Secondly, cybersecurity teams are used to responding to immediate threats, whereas quantum risk requires acting on probability distributions and systemic consequences. Thirdly, organizations often conflate the existence of standards with the ease of implementation, when in fact deploying post-quantum cryptography at scale is a complex task.

Quantum Risk as a Near-Term Cyber Threat and Strategic Risk

Ghose views quantum risk as both a near-term cyber threat and a strategic “balance sheet risk” that firms are failing to quantify properly. In the near term, the risk is confidentiality erosion via harvesting and long retention horizons, particularly relevant for institutions that process data whose value persists for years or decades. Once this privacy is lost historically, it cannot be reversed by later migration. At the same time, quantum risk is a strategic threat to the trust infrastructure that underpins financial intermediation, including authentication, signatures, secure communications, and software supply chains.

Consequences of Not Addressing Quantum Risk

If quantum risk is not addressed, the first place it may break the financial system is in high-value payment settlement and the trust fabric around it, with downstream effects propagating quickly across markets and the real economy. However, the “first break” may not look like a dramatic payments outage, but rather compromised authenticity, such as forged digital signatures, impersonated privileged identities, or software updates that validate as trusted.

Mitigating Quantum Risk

To mitigate quantum risk, Ghose recommends that CISOs and boards plan around a timeline that takes into account the probability of widespread breaking of public-key encryption and the duration of their migration efforts. Credible estimates place the probability of such an event by 2034 in the 19 to 34 percent range, rising materially by 2044. Large institutions need multi-year change cycles to inventory cryptography usage, remediate integrations, re-issue certificates, and retrain teams.

A Phased Migration Approach

The most realistic path forward is a phased migration that uses hybrid approaches where appropriate, anchored by crypto-agility as an architectural goal. This approach involves identifying where public-key cryptography is used, prioritizing critical systems and long-lived data, enabling crypto-agility and hybrid approaches, migrating via a phased plan, and sustaining continuous key management and rotation.

Regulatory Momentum

Regulatory momentum is also playing a crucial role in shaping market expectations, particularly for regulated ecosystems and critical infrastructure. In the U.S., federal migration milestones, such as carrying out high-risk migrations by 2030 and achieving full quantum-resistant security by 2035, are influencing broader market expectations.