Quantum computers could cause a crisis worse than Y2K

Quantum computers could cause a global security crisis that will make the once-dreaded millennium bug, or Y2K, look quaint. This infamous computer risk has been averted thanks to the persistent behind-the-scenes work of engineers around the world, but whether the new threat will be similarly addressed is a pressing but unresolved question.

Most digital communications and transactions are protected by cryptography based on mathematical problems that are unsolvable by conventional computers but are solvable by a sufficiently capable quantum computer. Scientists have understood this since the late 1990s, but the day when this sufficiently capable quantum computer would come online – or Q-Day – was thought to be a very distant future. A lot has changed since then.

Working quantum computers are now a reality, and recent leaps in how to use them are bringing Q-Day ever closer.

As of early 2026, several studies have found that the two most common encryption methods, RSA-2048 and ECDLP-256, could be broken by quantum computers, which are expected to exist by the end of the decade. cyber security experts, including those at Googlewhose team produced one such bombshell study, point to 2029 as the year by which everyone must be prepared for this quantum threat.

Solutions exist in the form of a set of algorithms called post-quantum encryption (PQC) – but how much of our deeply digitized world will adopt them over time?

“[Experimental] timelines can move faster than expected, and that in itself is reason to act. Institutions that start now will be in a very different position than those that wait,” he says Philip Intalura at the HSBC Group bank.

“The message we’ve given to almost all of our customers is, ‘Please don’t take it lightly,'” he says Raman Kompell at the technology giant Cisco. “The time to prepare your infrastructure for these quantum threats is today. In fact, it might as well have been yesterday.”

Kompella says Q-Day is a more sinister threat than Y2K because it could happen more covertly. The danger of Y2K was that the world’s computers could not properly represent years later than 1999, so everything from bank servers to airplane navigation systems would fail simultaneously at the turn of the millennium. By comparison, Q-Day could take place at any time and without fanfare; your most sensitive information can be stolen without anyone noticing.

One such specific threat is “harvest now, decrypt later” attacks, where hackers may already have sensitive data and could decrypt it using a quantum computer in the future.

Rebecca Krauthammer at PQC QuSecure says this is extremely concerning for information related to national security, banking, healthcare and the pharmaceutical industry. Risks include credit card hacking and theft of weapon launch codes, sensitive medical records or trade secrets.

“Banks, insurance companies, healthcare providers and critical infrastructure operators face existential risks. Even ‘secure’ data in transit or at rest today can support future extortion, espionage or fraud,” he wrote. Brian Lenahan at the Quantum Strategy Institute think tank in a blog post.

Krauthamer says that quantum cybersecurity experts have been anticipating developments like the recent flurry of studies on shrinking Q-Day timelines, but the past month has seen an extraordinary amount of interest in PQC. “This is one of the biggest catalyst moments I’ve seen,” she says. She estimates that her team has seen a tenfold increase in inquiries from companies wanting to be more quantum secure. Moving to PQC by 2029 is ambitious but realistic, he says.

Many telecommunications and banking institutions are already working on it, while others, such as hospitals, are lagging behind, Krauthamer says. Intallura says HSBC has been working to make itself more quantum secure for several years, and Kompella says many Cisco products already include some level of post-quantum security.

A hidden vulnerability

There are plenty of apps that already use PQC, including the messaging app Signal and Flo, the menstrual cycle tracking app. Others are working on it, such as the Google Chrome web browser, which aims to be quantum secure by 2027.

However, according to him, application upgrades alone will not be enough Martin Charbonneau at Nokia. Upgrading the security of entire digital systems, where the organizations involved often do not have accurate knowledge of all their technologies, is a more formidable challenge.

Every part of a corporate network is a potential vulnerability. Adversaries could attack things like alerting a user or verifying their credit card at a store, but they could also attack a remote server that’s starting up, or intercept communications between two internal computers, such as hospital computers exchanging patient files. For many companies, the first challenge in deciding how to become quantum secure will be identifying all the different points of vulnerability, especially if they have legacy software and devices that are decades old, Kompella says.

While firms like Cisco and Nokia are large enough to have in-house quantum research teams, most are not. Krauthammer says her team is currently working with three organizations that will need to spend an estimated $100 million over three to 10 years to transition to PQC. Many companies will also quickly find themselves under pressure to transition to PQC by 2027, when it becomes a requirement to work with the US government’s National Security Branch.

But even if all goes according to plan, one industry may remain in trouble: cryptocurrency. In their study, researchers from Google and the Ethereum Foundation suggested that the first sign that Q-Day has arrived could be a hacker stealing a cryptocurrency like Bitcoin by intercepting a transaction or targeting old and inactive wallets. Unlike banks, which can make large-scale top-down PQC implementation decisions, cryptocurrencies are decentralized and are expected to take longer to decide if and how to make the change as they seek consensus among many users. Bitcoin in particular has struggled with changes to its algorithms, such as reducing environmental impact.

But cryptocurrency is no longer just a fringe interest. Pension funds, charities and companies they increasingly include it in their investment portfolios. It’s embedded enough in the global economy that if it lost value because it turned out to be unsafe, more people than just crypto enthusiasts would lose money, he says Stefano Gogioso at Oxford University. Several cryptocurrencies already implement quantum secure procedures increased by up to 50 percent in value on the day following the publication of the latest studies.

After all, Q-Day could be averted much like Y2K – if governments and businesses around the world can move fast enough. But the barriers are higher this time because the threat is complex and it is not known exactly when it will occur.

For these reasons, Krauthamer thinks people need to make noise about it. “There needs to be a lot more bottom-up pressure from the people using the services. They should be saying, ‘Hey, to trust that you’re going to keep my data safe today and tomorrow, I need to see that you’re adopting post-quantum cryptography,'” he says.

topics: