Quantum threat: Someone today can steal your encrypted data and wait years to read it

A new study has revealed that quantum computers could potentially break current internet encryption methods within seconds, a threat that experts warn is already being prepared for today. According to research conducted by American cybersecurity firm F5, more than half of the world’s most visited websites are already equipped with post-quantum cryptographic security measures. However, this progress is largely attributed to the automatic implementation by the cloud service provider Cloudflare, which has enabled these protections for all its users. Without websites passing through Cloudflare's network, the global share of protected sites drops drastically to just 22 percent. The European Union faces a significant lag compared to the United States in preparing for this technological shift. In the U.S., 62 percent of corporate websites have implemented post-quantum security, while in France, the figure stands at 39 percent and in Germany, it is only 36 percent. Experts attribute this gap to Europe's preference for local servers over global cloud platforms. The most vulnerable sectors, government agencies and telecommunications providers, are particularly at risk, with only 35 percent of them adequately protected. According to a European plan announced last June, member states were required to develop national plans by December 31, detailing what data is encrypted and where, along with launching pilot projects. Critical systems such as energy, water, healthcare, transportation, and finance should be secured by the end of 2030, with the rest following by 2035 if possible. However, the plan is currently a recommendation rather than a legal requirement, meaning there are no penalties for delays. Negotiations are ongoing in both the European Parliament and the Council of the European Union, and once adopted, member states would have one year to incorporate the guidelines into their national laws. This issue affects everyone who uses mobile phones, online banking, or electronic services. The security measures protecting passwords, money, health records, and private messages are largely the same ones that quantum computers could potentially break. If the transition is delayed, the risks extend beyond governments and banks to affect individuals directly. Political pressure is mounting. Henna Virkkunen, Deputy President of the European Commission, emphasized during the announcement of the plan that the new protection is crucial for maintaining high levels of cyber security. Vincent Strubel, director of the French agency ANSSI, stated that starting in 2027, France will only evaluate security products with the new protection, and from 2030, it will not recommend purchasing products without it. F5's data is not the only indicator of Europe's lag. An assessment by ENISA, the European Agency for Cybersecurity, involving more than 1,350 organizations across 27 countries showed that most are unprepared, with some operators in critical sectors not planning to invest at all. The German agency BSI reduced its estimate of the danger from 20 to 10 years. Stefan-Lukas Gazdag, a security expert at the German company Genua, noted last summer that the first attacks using quantum computers might become feasible by the end of the decade. Almost all internet security, from the familiar lock icon in browsers to digital signatures, is based on complex mathematical problems that current computers cannot solve in a reasonable time frame. However, sufficiently powerful quantum computers could overcome these obstacles effortlessly. Post-quantum cryptography introduces advanced "locks" that function reliably on ordinary computers and remain impervious even to quantum computers. Such machines do not exist yet, but the threat is real today. Attackers can already intercept and store encrypted data, waiting to decrypt it once quantum technology becomes available. Olivier Daloy, a security expert at Zscaler, vividly describes this risk: someone sends a doctor a medical report or sensitive information to a bank, everything is properly encrypted. An attacker intercepts and stores it, but currently cannot read anything, yet patiently waits.