What is a "Harvest now, decrypt later" (Y2Q) attack?

Attackers record encrypted data today, planning to decrypt it once quantum computers can break today's crypto.

Even if you can't read intercepted ciphertext now, you can store it and wait. When sufficiently powerful quantum computers arrive ("Y2Q" — Years to Quantum), algorithms like RSA and ECC could be broken, retroactively exposing everything harvested.

Why it's a today-problem, not a tomorrow-problem: data with a long secrecy lifetime (medical records, state secrets, biometric data) that's stolen now is already at risk. This drives the move to post-quantum cryptography (PQC) — NIST standardised the first PQC algorithms (e.g. ML-KEM/Kyber) in 2024.

Tip: This specifically attacks confidentiality across time — the one CIA goal where a violation can stay invisible for years.