Europol and UC3M's 7 October 2026 Harvest Now, Decrypt Later Report Puts Health Records in the Ten-Year Risk Window: Hospital TLS, Archives and the EU Roadmap's 2030 Target
Quentir Medicine Monitor
Evidence-based insights for quantum medicine. Published by Quentir Systems LLC · October 11, 2026.
A patient's file can stay sensitive for most of a lifetime. A diagnosis made in childhood, a psychiatric admission, an HIV test or a genetic result can still matter to that person forty years later, for insurance, for employment and for plain dignity. The symmetric ciphers that encrypt the content of that file, such as AES-256, are considered robust against quantum attack. The weak point is the public-key cryptography, RSA and elliptic curves, that sets up those content keys in transit or wraps them in an archive. It was designed for a far shorter horizon, and it rests on mathematics that a large enough quantum computer is expected to break.
On 7 October 2026 Europol put that mismatch on paper. Its cybercrime unit, EC3, released two reports on quantum computing, and the second, titled harvest now, decrypt later and written jointly with Universidad Carlos III de Madrid (UC3M), lists medical records among the kinds of information that must stay confidential for many years and are therefore worth stealing in encrypted form today. The attacker in this scenario needs no quantum computer at the moment of theft. They copy encrypted traffic or files now and keep them until the means to read them exists.
For hospital security officers, health-IT vendors and the people who buy their systems, the report is useful because it is specific. It names the protocols at issue, explains which configurations leak the most, and ties its advice to the move to post-quantum cryptography, the new public-key algorithms designed to resist both conventional and quantum attack. It also says plainly that there is currently no clear evidence of this technique being exploited systematically at scale.
What Europol and UC3M published on 7 October 2026
The Europol press release of 7 October 2026 announces two publications. The first, on cryptocurrencies, concludes that wallet keys are the main point of exposure for digital assets. The second, the Harvest Now, Decrypt Later report, was produced by Europol and UC3M within the Europol EC3 Advisory Group on Research and Development. The release states that the approach is particularly relevant to government communications, intellectual property, medical records and law enforcement files.
The report's own stakeholder table is more granular. It rates citizens and private individuals at low to medium risk, and names individual medical histories, alongside financial records and personal identifiers, as data that could later be used for identity theft or blackmail. Companies are rated medium to high, governments high. A hospital sits awkwardly across those rows: it holds the medical histories of thousands of individuals, it runs as a sizeable organization with suppliers and contracts, and in many European countries it is part of the public sector.
Europol's defense-relevant reading of the same report, centered on diplomatic cables and case files, appeared on this site as a Defense Monitor analysis of the TLS, SSH and OpenPGP findings. The medical question is narrower: how long a patient file has to stay secret, and whether the key exchange protecting it today can hold for that long. Our earlier piece, The Patient Record Outlives Its Encryption, made that argument in general terms; the Europol report adds a law enforcement agency's threat assessment, protocol-level findings and a stakeholder risk scale.
Why a patient file needs protection for more than ten years
The report's managerial chapter asks organizations to identify which data carry long-term confidentiality requirements. It states that personal health records, classified government communications, intellectual property and law enforcement case files may well exceed a ten-year sensitivity window, which places them in the risk zone for this kind of attack.
Ten years is the same threshold European governments use. The Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography, issued on 23 June 2025 by the EU Member States through the NIS Cooperation Group with Commission support, classes a use case as high-risk when a loss of confidentiality after ten years or more would still cause significant damage. Data in that class, the roadmap says, should be protected against quantum attack no later than the end of 2030.
Retention rules show how far beyond ten years health data can run. A Privacy Act notice covered on this site in September set destruction of one federal agency's medical applicant files at 50 years after service ends, as discussed in our reading of Peace Corps notice PC-38. Hospital archives, research biobanks and genomic datasets can likewise be kept for decades.
Quantum pillar: post-quantum cryptography. Technology readiness: TRL 7 of 9. The replacement algorithms are published federal standards and are starting to appear in vendor products and hybrid protocols, but they are not yet a routine part of hospital record systems, archives and medical-device links.
Where hospital exposure sits: TLS 1.2 without forward secrecy, SSH and encrypted archives
Most of the report's technical analysis deals with three everyday tools: TLS, which secures web and application traffic; SSH, which administrators use to reach servers; and OpenPGP, used here as the model for encrypted file storage. The finding that matters most for a hospital network is about older TLS configurations. In TLS 1.2 sessions that use RSA key transport, a recorded session can be decrypted once the server's long-term private key is recovered, so one broken key can open every captured session that relied on it. Sessions that run a fresh ephemeral (EC)DHE key exchange, the normal TLS 1.3 handshake, have forward secrecy, so each recorded session has to be attacked on its own. TLS 1.3 resumption with a pre-shared key alone, and 0-RTT early data, do not carry the same protection. Forward secrecy raises the cost of a mass attack, but it gives no quantum resistance: a quantum computer could still solve each recorded (EC)DHE exchange.
Hospitals typically run many older interfaces: laboratory feeds, picture-archiving links, connections to insurers, and medical devices with long service lives. Each of those can keep an old TLS configuration alive long after the main electronic health record has moved on. The report's advice for medium-risk organizations follows directly: upgrade to TLS 1.3 and SSH2, switch off legacy protocols, enforce forward secrecy, delete sensitive data that is no longer needed, and test hybrid post-quantum options as vendors make them available.
For stored data the report describes a hybrid approach for OpenPGP in which the symmetric key that encrypts a file is protected both by a conventional RSA or elliptic-curve key and by ML-KEM, the key-encapsulation standard NIST published as FIPS 203 on 13 August 2024. ML-KEM establishes key material; it does not encrypt the file itself. The report's example is direct: if an attacker recovers the RSA private key in 2035, the ML-KEM layer still protects the file content. For backups and long-term archives of patient data, that is the property that matters.
Which dates the EU roadmap recommends: end of 2026, end of 2030 and 2035
The EU roadmap sets three recommended milestones for Member States. It is a coordinated recommendation, not a regulation, and it creates no direct legal obligation for hospitals. National transition strategies and first steps should be in place by 31 December 2026. High-risk use cases, the ten-year class above, should complete the transition by 31 December 2030. As many systems as practically feasible should follow by the end of 2035. The roadmap aligns that last date with NIST IR 8547, the November 2024 draft in which the US standards body proposed that quantum-vulnerable public-key methods be disallowed after 2035, with configurations at 112-bit security deprecated after 2030.
The roadmap is addressed to governments, and it does not name hospitals. Health care enters through national plans, procurement rules and the cybersecurity duties hospitals already carry. Read together with the Europol report, the arithmetic is simple: a patient file created in 2026 that must stay confidential for twenty years falls squarely in the class the roadmap wants protected by the end of 2030.
What a hospital security lead can ask suppliers after the Europol report
The report recommends a cryptographic inventory first: TLS termination points, VPN gateways, SSH servers, backup and archive encryption, email, databases and internal services that depend on certificates. In a hospital, that inventory should include supplier connections and connected devices, because they are often where the oldest settings survive. Useful questions for suppliers follow from the report's findings. Does the product support TLS 1.3 with forward secrecy on every interface, including device and laboratory links? How are archived patient files and backups encrypted, and with which key-management model? Is a hybrid ML-KEM option on the product roadmap, and has it been tested for interoperability? And how long does the supplier keep copies of patient data it processes?
Europol's own caution deserves the same weight as its warning. The agency does not claim that health data are being harvested at scale today, and the timing of a cryptographically relevant quantum computer remains uncertain. The case for acting now rests on the length of migration projects and on the long life of the data, and both are within a hospital's own control.
Sources
Primary source: Europol's cybercrime unit EC3 and Universidad Carlos III de Madrid (UC3M), Harvest Now, Decrypt Later, published 7 October 2026 within the Europol EC3 Advisory Group on Research and Development. Also drawn on: Europol's press release of the same day, the NIS Cooperation Group's Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography of 23 June 2025, NIST FIPS 203 and the initial public draft of NIST IR 8547. The readiness rating and supplier questions are the Monitor's editorial assessment.