Loading story…
Germany has published joint national guidance for migrating to post-quantum cryptography (PQC), adopting the European Union’s risk-based transition timetable. Issued by the interior and digital ministries and the Federal Office for Information Security, the guidance calls for high-risk use cases to become quantum-safe as soon as possible and no later than the end of 2030, medium-risk use cases by 2035, and low-risk use cases as far as possible by 2035. Organizations are expected to assign migration ownership, develop implementation plans, establish an initial cryptographic inventory and begin migration by December 31, 2026. The dates are currently recommendations rather than universally binding requirements; German authorities are expected to make deadlines binding before year-end, while existing cybersecurity laws already impose cryptographic risk-management duties on many regulated entities.
The guidance recommends hybrid combinations of classical and post-quantum algorithms, supplier coordination, crypto-agile procurement and emergency planning. It does not explicitly include the pilot projects required by the EU roadmap. Although the arrival of quantum computers capable of breaking RSA remains uncertain, long-lived systems and harvest-now-decrypt-later attacks make delayed migration a confidentiality risk today. Security leaders should prioritize cryptographic discovery and risk classification, identify dependencies on suppliers, and build migration plans around data-retention needs and system replacement cycles.
Track how attackers are adapting to this technology.
7 events from the most recent confirmed update back to the earliest known activity.
BMI, BMDS and BSI published joint guidance adopting the EU roadmap’s migration timelines and recommending organizational ownership, cryptographic inventories, hybrid cryptography and crypto-agile procurement. The dates remain recommendations, with relevant German coordinating bodies asked to adopt them as bindingly as possible by the end of 2026.
The BSI advised against using Classic McEliece in new developments following reduced key-recovery cost estimates. It stated that no practical attack existed against its recommended parameter sets.
EU member states published a three-stage roadmap requiring national migration roadmaps by the end of 2026. It targets completion of high-risk migration by the end of 2030 and medium-risk migration by the end of 2035, with low-risk migration by 2035 where practicable.
The BSI’s 2025 quantum-computing study assessed a cryptographically relevant quantum computer as likely by 2040 or earlier. Germany’s subsequent migration guidance cited this assessment.
A 2023 BSI survey conducted with KPMG found that almost 90% of 28 participating companies and organizations believed they could not counter the quantum threat to cryptography in time.
Pilot projects for a quantum-safe electronic passport and a quantum-safe identity card were already underway. Their start dates were not specified.
The BSI established binding deadlines requiring approved IT security products used in the classified domain to complete their post-quantum transition by 2030. The source does not specify when those deadlines were established.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The G7 Cybersecurity Working Group has called on governments and organizations across all sectors to begin preparing immediately for a transition to **post-quantum cryptography (PQC)**. The group highlighted the current “harvest now, decrypt later” threat: adversaries can collect encrypted information today and retain it until cryptographically relevant quantum computers can break existing public-key encryption, placing long-lived sensitive data at risk. The non-binding call prioritizes awareness, national strategies, research, public-private cooperation, and embedding PQC in cybersecurity requirements. Organizations should begin with a cryptographic inventory, defined ownership, limited pilots, crypto-agile architecture, hybrid standardized deployments, and PQC-focused procurement. EU member states are expected to have initiated national PQC strategies by the end of 2026, while high-risk environments—particularly critical infrastructure—should transition as early as possible and no later than the end of 2030; delayed adoption could also affect supplier eligibility for public-sector and other contracts.
Sep 11, 2026
Security experts are intensifying efforts to develop and implement post-quantum cryptography (PQC) in anticipation of the eventual arrival of quantum computers capable of breaking current encryption algorithms, a milestone referred to as "Q-Day." The transition to PQC is recognized as a complex, multi-year process that requires not only new cryptographic algorithms but also significant changes to cybersecurity infrastructure, including the adoption of hybrid solutions and the integration of PQC into zero-trust architectures. High-security sectors are particularly urged to begin migration early to mitigate the risk of "harvest now, decrypt later" attacks, where adversaries collect encrypted data now to decrypt once quantum capabilities are available. Industry analysts highlight that the migration to post-quantum encryption presents unique challenges compared to previous cryptographic upgrades, as it involves extensive updates to hardware, software, and system architectures. While some areas, such as blockchain, are not immediately threatened by quantum computing, the scale and complexity of the migration require coordinated efforts across security, product management, and IT operations. Experts emphasize the need for proactive planning and the adoption of best practices to ensure a smooth transition before quantum computers become a practical threat to digital security.
Jul 12, 2026
Organizations are accelerating **post-quantum cryptography (PQC)** planning amid concerns that adversaries are already conducting “**harvest now, decrypt later**” operations—collecting encrypted traffic today for future decryption once sufficiently capable quantum computers emerge. A supply-chain-focused analysis highlighted that procurement and third-party ecosystems often rely on long-lived trust anchored in **RSA** and **ECC**, and that sensitive data exchanged across supplier onboarding, invoicing, contracts, pricing, and banking workflows could be exposed retroactively if captured now and decrypted later. A U.S. State Department cybersecurity official urged tighter **public-private coordination** on PQC migration, framing quantum resilience as an ecosystem-wide modernization effort rather than isolated upgrades by individual organizations. The official emphasized that adversaries (including **China**) can target entire digital ecosystems, and argued that transition plans must account for long-term national security risks such as data harvesting, with modernization efforts designed to reduce predictability and strengthen collective defenses across interconnected systems, devices, and data flows.
Aug 31, 2026