Europol and UC3M's 7 October 2026 Harvest Now, Decrypt Later Report Puts Health Records in the Ten-Year Risk Window: Hospital TLS, Archives and the EU Roadmap's 2030 Target
Europol names medical records among data worth stealing now and decrypting later
Quentir Medicine Monitor
Evidence-based insights for quantum medicine.
A patient's file can stay sensitive for most of a lifetime. A diagnosis made in childhood, a psychiatric admission, an HIV test or a genetic result can still matter to that person forty years later, for insurance, for employment and for plain dignity. The symmetric ciphers that encrypt the content of that file, such as AES-256, are considered robust against quantum attack. The weak point is the public-key cryptography, RSA and elliptic curves, that sets up those content keys in transit or wraps them in an archive. It was designed for a far shorter horizon, and it rests on mathematics that a large enough quantum computer is expected to break.
On 7 October 2026 Europol put that mismatch on paper. Its cybercrime unit, EC3, released two reports on quantum computing, and the second, titled harvest now, decrypt later and written jointly with Universidad Carlos III de Madrid (UC3M), lists medical records among the kinds of information that must stay confidential for many years and are therefore worth stealing in encrypted form today. The attacker in this scenario needs no quantum computer at the moment of theft. They copy encrypted traffic or files now and keep them until the means to read them exists.
For hospital security officers, health-IT vendors and the people who buy their systems, the report is useful because it is specific. It names the protocols at issue, explains which configurations leak the most, and ties its advice to the move to post-quantum cryptography, the new public-key algorithms designed to resist both conventional and quantum attack. It also says plainly that there is currently no clear evidence of this technique being exploited systematically at scale.
The Europol press release of 7 October 2026 announces two publications. The first, on cryptocurrencies, concludes that wallet keys are the main point of exposure for digital assets. The second, the Harvest Now, Decrypt Later report, was produced by Europol and UC3M within the Europol EC3 Advisory Group on Research and Development. The release states that the approach is particularly relevant to government communications, intellectual property, medical records and law enforcement files.
Post-Quantum Authentication for Internet of Medical Things Devices: Sutradhar and Venkatesh's Lattice-Signature Prototype of 3 October 2026 and the Gap to NIST FIPS 204
Post-quantum signatures for medical device reports
Quentir Medicine Monitor
Evidence-based insights for quantum medicine.
A heart-rate reading from a wearable patch or a bedside monitor only helps a clinician if it really came from that patient's device and arrived unchanged. Hospitals already depend on digital signatures for that assurance, and most of those signatures rest on mathematics that a large quantum computer is expected to break.
Two computer scientists in India have posted a prototype that addresses this problem for the Internet of Medical Things, the growing population of connected wearables, bedside monitors and telemedicine devices. Kartick Sutradhar of the Indian Institute of Information Technology Sri City and Ranjitha Venkatesh of GITAM University Bengaluru describe a scheme for post-quantum authentication of medical device reports in arXiv preprint 2610.04661, posted on 3 October 2026. Its most practical feature is batch verification: a hospital gateway checks the signatures of many incoming reports in one vectorized step instead of one by one.
For a chief information security officer, a biomedical engineering lead or a procurement team writing device requirements, the paper gives a clear picture of what a quantum-resistant telemetry chain has to do, and it shows how much work remains between a laboratory prototype and a device a hospital could buy.
The design has three parts. First, each patient device packages its readings, such as heart rate, blood oxygen saturation (SpO2) and temperature, into a medical report in canonical JSON, a fixed text layout that always produces the same bytes for the same content. The report carries a timestamp, and the device signs it with a private key using what the authors call an ISIS-like lattice construction, a signature built on a hard problem over mathematical lattices.
Second, a hospital gateway receives the reports, looks up each patient's public key and checks every signature. Because the timestamp is inside the signed content, a captured report cannot simply be sent again later without detection, provided the gateway enforces a time window or rejects duplicates, which the authors list as an implementation requirement.
SEALSQ's 9 September 2026 Interview on Fifteen-to-Twenty-Year Medical Device Lives, and the QS7001 Page That Still Lists Kyber and Dilithium 2
Quentir Medicine Monitor
Evidence-based insights for quantum medicine.
On 9 September 2026 Carlos Moreira, founder and chief executive of the Nasdaq-listed semiconductor company SEALSQ, described in a published interview a post-quantum exposure specific to connected physical systems, among them medical devices, which he sets alongside the familiar risk of stored data waiting to be decrypted later. His reason rests on an arithmetic any hospital finance office already runs: equipment bought today could remain in service well beyond the transition date NIST has proposed.
Many connected devices stay fifteen or twenty years in service and cannot be swapped out quickly. A draft NIST report proposes that the public-key algorithms those devices ship with become disallowed after 2035, with the weaker parameter sizes deprecated five years earlier. The company's answer is a secure microcontroller called the QS7001, whose product page names medical and healthcare devices as a target market, and whose specification sheet still lists Kyber and Dilithium 2, the names those algorithms carried before NIST standardized them.
Stony Brook Aims Its Quantum Network at University Hospital Patient Data: What the 21 August Link to Brookhaven Actually Carried
Quentir Medicine Monitor
Evidence-based insights for quantum medicine.
A 375-square-foot galvanized steel chamber now sits on the roof of Stony Brook University's Health Sciences Center, fourteen floors above the medical campus and reached by two final flights of stairs. Its builders call it the Quantum Watchtower, and they say the instruments inside will one day protect Stony Brook University Hospital patient data against cyberattack by teleporting quantum information.
That sentence was published on 28 August 2026 by Jess Stallone in Stony Brook Matters, the university's news site for alumni. One week earlier, on 21 August, Stony Brook and the Department of Energy's Brookhaven National Laboratory announced the demonstration behind it: a working free-space optical link carrying quantum information across 13 miles of open Long Island air. For a hospital reader the useful exercise is to hold the two statements next to each other, because they describe different stages of the same project.
What crossed the 13 miles between Stony Brook and Upton on 21 August 2026
The Watchtower is one end of a pair. The other is the Quantum Lighthouse, a nearly identical steel structure built by Brookhaven Lab at Upton, New York, 13 miles east, positioned for a clear line of sight back to campus. At the "First Light" event on 21 August, researchers generated quantum states of light at the Stony Brook rooftop and sent them across the open air to the Lighthouse. The university describes what was transmitted as "quantum states of light, each containing just a few individual photons," which is a weak coherent source rather than a true single-photon emitter. That daytime run demonstrated that the optical path could be aimed and held steady.
The entanglement work happened separately, at night, when the sky's background light drops far enough for faint signals to be picked out. Entangled photon pairs were generated in a Stony Brook physics laboratory, carried by fiber to the Watchtower, launched across the 13 miles, and measured at the Lighthouse. Justine Haupt, the Brookhaven engineer leading the link, came to it from astronomical instrumentation. "It's exciting to take capabilities we've spent years refining for astronomy and adapt them for a completely different scientific problem," she said.
The Patient Record Outlives Its Encryption
Medical data has a longer clock
Long-lived medical data creates a timing problem that ordinary security planning can miss. A genome, a childhood record, a psychiatric history, or a diagnostic image can remain sensitive for decades. The public-key encryption and identity systems around those records will change much sooner. A July 2026 Frontiers in Health Services review connects that mismatch to harvest-now-decrypt-later risk: encrypted health traffic can be collected while current protection still holds and revisited if future quantum computers can break the algorithms that protected it. The exposure reaches across electronic health records, imaging archives, genomic repositories, telemedicine, research networks, and connected devices.
The standards are ready; the estate is mixed
Post-quantum cryptography now has deployable standards, including NIST's FIPS 203 for ML-KEM. It runs on classical computers and can enter many healthcare systems through software, protocols, certificates, or gateways. The clinical estate remains uneven. A hospital can operate modern cloud services beside imaging equipment with long service lives, laboratory instruments with vendor-controlled updates, old identity systems, and low-power devices that cannot absorb larger keys or signatures without measurement. The transition therefore depends on cryptographic identity, ownership, service life, memory, bandwidth, and the vendor's ability to update a product already in use.
Why integrity belongs beside privacy
Confidentiality is only half of the medical stake. Digital signatures help establish that firmware, certificates, audit records, and clinician identity assertions came from an authorized source. The Frontiers review identifies software update signatures as part of the integrity target for healthcare. A future weakness in that trust chain would not automatically alter a dose or disable an implant, but it would weaken confidence in the code and credentials around clinical action. Quentir reads the paper as a three-clock problem: the lifetime of the information, the replacement cycle of the system, and the arrival of a capable adversary. A credible migration preserves care while the mathematics underneath privacy and trust changes.