Adversaries are stockpiling encrypted data to decrypt with future quantum computers

Adversaries are scooping up encrypted internet traffic today and saving it for a day when a quantum computer can crack the math. The model has a name: "harvest now, decrypt later," or HNDL, and the longer a piece of data stays sensitive, the more plausible the attack gets.

That is the threat security teams now cite as their top quantum-era concern, and the one Thales, the French defense and cybersecurity company, says it is selling against. The product is Luna 8, a hardware security module (HSM), meaning a tamper-resistant appliance used by banks, governments, and cloud providers to generate, store, and use the cryptographic keys that protect everything from card transactions to code-signing certificates. Thales's pitch is cryptographic agility: the ability to add a new encryption algorithm through a firmware update, without replacing the physical box.

The U.S. National Institute of Standards and Technology finalized its first post-quantum cryptography standards in 2024. The algorithms, ML-KEM for key exchange, ML-DSA for digital signatures, and SLH-DSA as a hash-based backup, give enterprises a concrete target. What they have not given enterprises is a clean way to deploy them inside the existing HSM fleets that already sign their traffic, encrypt their databases, and anchor their public key infrastructure (PKI). Replacing every HSM in a data center is the kind of capex cycle that takes a decade, so the question for any chief information security officer becomes: how do I add a new algorithm without replacing the box?

Luna 8 uses a custom Thales cryptographic processor, takes firmware updates for the NIST-finalized post-quantum algorithms, and is also pitched at high-throughput AI workloads where training pipelines need rapid key generation and signing. Thales says the appliance is in evaluation for FIPS 140-3 Level 3, the U.S. government standard for cryptographic modules, and for the EU's Common Criteria scheme. The box is designed to slot into existing Luna HSM deployments and to extend the payShield 11K payment HSM line that runs a large share of the world's card-issuing infrastructure. Payment networks, card brands, and the banks that ride on them operate on multi-year certification cycles, and any PQC migration that does not preserve the payShield upgrade path forces those institutions into a parallel procurement. Thales is positioning the migration as a single trade.

The market context, as Thales would like it framed, comes from the company's own 2026 Data Threat Report. The survey of 3,120 IT and security professionals found 61% citing HNDL as their primary quantum concern and 59% saying they are actively prototyping or evaluating post-quantum algorithms. A separate Financial Services edition, with 237 respondents across 20 countries, found 79% running five or more data protection tools and 48% running five or more key management systems. That tool sprawl is exactly the consolidation story Luna 8 is sold into. Independent coverage of the DTR findings, like this summary from TMPC, restates the same messaging, which is what one would expect from a vendor-commissioned survey.

These are vendor-commissioned numbers, not independent market data. Thales has a financial interest in showing that the migration is urgent, fragmented, and best handled by a single appliance. Treat the survey figures as evidence of how Thales is positioning the launch. The more durable claim is the gap the survey itself surfaces: 59% are prototyping, which is a long way from running PQC in production.

What to watch: NIST's published migration timeline for federal systems, which sets a de facto floor for private-sector buyers. Competing HSM vendors, including Entrust, Utimaco, AWS CloudHSM, and IBM, are at various points on the same firmware-upgradability curve. The procurement question every enterprise buyer should be able to answer: when the next post-quantum algorithm ships, do you have to forklift your hardware, or can you flash the firmware?