The Risk Posed by “Harvest Now, Decrypt Later”
Encryption has long been foundational to financial services security, protecting customers’ personally identifiable information (PII), account information, payment transactions and proprietary business data. Historically, even if attackers gained access to encrypted data, it remained unusable.
That assumption is changing due to the threat of “harvest now, decrypt later” (HNDL) attacks. Cybercriminals are already stealing encrypted data today with the expectation that it can be decrypted in the future using quantum computers.
This threat is particularly acute for financial institutions because of the long-term value of financial data. Customer account histories, loan records, insurance policies, investment data and transaction logs may remain valuable for decades. Once stolen, there is no way to retroactively protect that data from future decryption.
To mitigate this risk, financial institutions must begin preparing now to ensure that data stolen today cannot be decrypted tomorrow.
Solution: The Arrival of Post-Quantum Cryptography
In May 2022, National Security Memorandum 10 directed federal agencies to prepare for the threat of quantum decryption by migrating vulnerable systems to quantum-resistant cryptography. While the directive applies to government agencies, it signals broader expectations for regulated industries such as financial services.
“Post-quantum cryptography is about proactively developing and building capabilities to secure critical information and systems from being compromised through the use of quantum computers,” said Rob Joyce, then director of cybersecurity for the National Security Agency, in an August 2023 statement.
In August 2024, NIST published three post-quantum cryptographic standards — ML-KEM, ML-DSA and SLH-DSA — designed to withstand quantum attacks. These standards are intended to secure data across systems such as digital banking platforms, payment processing environments, email and e-commerce. NIST has encouraged organizations to begin implementation as soon as possible.
Technology vendors such as Cisco Systems, Check Point and Palo Alto Networks have introduced security products that support post-quantum cryptography. Firewalls, network switches and other infrastructure components with PQC capabilities can help financial institutions protect data both in transit and at rest.
“It is imperative for all organizations, especially critical infrastructure, to begin preparing now for migration to post-quantum cryptography,” said Jen Easterly, then director of the Cybersecurity and Infrastructure Security Agency, in an August 2023 statement.
