Europol and UC3M's 7 October 2026 Harvest Now, Decrypt Later Report Puts Health Records in the Ten-Year Risk Window: Hospital TLS, Archives and the EU Roadmap's 2030 Target
Europol names medical records among data worth stealing now and decrypting later
Quentir Medicine Monitor
Evidence-based insights for quantum medicine.
A patient's file can stay sensitive for most of a lifetime. A diagnosis made in childhood, a psychiatric admission, an HIV test or a genetic result can still matter to that person forty years later, for insurance, for employment and for plain dignity. The symmetric ciphers that encrypt the content of that file, such as AES-256, are considered robust against quantum attack. The weak point is the public-key cryptography, RSA and elliptic curves, that sets up those content keys in transit or wraps them in an archive. It was designed for a far shorter horizon, and it rests on mathematics that a large enough quantum computer is expected to break.
On 7 October 2026 Europol put that mismatch on paper. Its cybercrime unit, EC3, released two reports on quantum computing, and the second, titled harvest now, decrypt later and written jointly with Universidad Carlos III de Madrid (UC3M), lists medical records among the kinds of information that must stay confidential for many years and are therefore worth stealing in encrypted form today. The attacker in this scenario needs no quantum computer at the moment of theft. They copy encrypted traffic or files now and keep them until the means to read them exists.
For hospital security officers, health-IT vendors and the people who buy their systems, the report is useful because it is specific. It names the protocols at issue, explains which configurations leak the most, and ties its advice to the move to post-quantum cryptography, the new public-key algorithms designed to resist both conventional and quantum attack. It also says plainly that there is currently no clear evidence of this technique being exploited systematically at scale.
The Europol press release of 7 October 2026 announces two publications. The first, on cryptocurrencies, concludes that wallet keys are the main point of exposure for digital assets. The second, the Harvest Now, Decrypt Later report, was produced by Europol and UC3M within the Europol EC3 Advisory Group on Research and Development. The release states that the approach is particularly relevant to government communications, intellectual property, medical records and law enforcement files.