French public authorities are facing cyberattacks and data breaches that reveal the scale of the risks associated with concentrating sensitive information. Europol is now warning of a longer-term threat: quantum computers could one day undermine certain encryption methods. Although this capability does not yet exist, preparations need to begin now, because replacing security measures will take time.
Recent attacks on French public-sector organizations have shown that a security breach can quickly grow beyond the scope of an isolated incident. Tax and land registry data have been among the information leaked, while details belonging to millions of people have circulated following various intrusions. When large volumes of data are centralized, a compromise can affect citizens and public services, and undermine trust in institutions.
The available figures illustrate this trend. The French National Cybersecurity Agency (ANSSI) recorded 196 data exfiltrations in 2025, compared with 130 the previous year. In addition, a Surfshark study estimates that 43.4 million French accounts were compromised in the first half of 2026. These figures do not all reflect the same type of incident, but they highlight the persistent vulnerability of digital systems.
This immediate pressure is compounded by a need to prepare: some cryptographic methods used today could become vulnerable if sufficiently powerful quantum computers are developed. In its warning, Europol is not claiming that cybercriminals already have such machines. The challenge is to anticipate a technological development that could transform the security of digital communications and archives.
Why quantum computing is a concern for cybersecurity experts
Encryption systems protect a significant part of our digital lives: communications, transactions, access to services and exchanges between government agencies. Some of these mechanisms rely on mathematical problems that are difficult to solve using conventional computers. This difficulty helps protect keys and keep information unreadable to unauthorized users.
Quantum computers would harness phenomena specific to quantum physics to process certain calculations using different methods. If a machine reached sufficient processing power, it could attack security measures that rely on the difficulty of deriving a private key from a public key. In some cases, this could make it easier to decrypt communications or forge digital signatures.
This threat remains hypothetical: current capabilities are not sufficient to break the main cryptographic systems covered by the warning. This is therefore not an announcement that all digital security is about to collapse. However, IT infrastructures are complex, and transforming them takes time, making it necessary to prepare in advance.
The risk of “harvest now, decrypt later”
Europol is drawing attention to a strategy that involves stealing encrypted data today and then attempting to read it later, when the technology makes this possible. Information may be unusable at the time it is stolen while retaining significant value for an attacker over the long term.
This scenario is particularly relevant to data that must remain confidential for years. Medical records, government communications, police files and trade secrets can remain sensitive long after they are collected. A security measure that seems sufficient in the short term may therefore be inadequate for archives kept over a long period.
The level of risk varies depending on how the data is used. It depends in particular on the cryptographic protocols in use, how keys are generated and stored, and how long the information must remain confidential. Encrypted data is therefore not all equally exposed, and organizations need to assess risks on a case-by-case basis.
Cryptocurrency wallets among the targets to watch
Digital assets offer a concrete example of how a cryptographic weakness could have direct consequences. Europol’s European Cybercrime Centre identifies cryptocurrency wallet keys as a particularly sensitive point. If a private key were compromised, a third party could potentially authorize transfers without the owner’s consent.
However, the mechanisms used to preserve the integrity of blockchains, including hash functions, have different characteristics and are considered more resistant to this type of threat. This should not be taken to mean that cryptocurrencies will automatically collapse. Security depends on the methods used, how they evolve and whether stakeholders can adapt their systems before a concrete threat materializes.
Some projects in the sector are already exploring these issues. For example, Algorand’s roadmap for strengthening its resilience against quantum threats illustrates initiatives underway to prepare the infrastructure supporting digital assets.
Post-quantum cryptography: a path to start pursuing now
Solutions are already being developed and can run on conventional computers. Post-quantum cryptography refers to algorithms designed to withstand the attacks anticipated in the quantum era. Their existence does not solve everything, however: organizations need to determine where to use them, check their compatibility with existing systems and plan their adoption.
The migration often involves far more than simply replacing software. Encryption may be built into equipment, applications, networks, outsourced services and systems that have been in use for years. Organizations must also account for communications with partners and systems that cannot be changed quickly without disrupting essential activities.
A gradual transition makes it possible to identify these dependencies before they become an obstacle. Organizations can start by taking inventory of their cryptographic mechanisms, keys and protected data. This makes it possible to identify the information that is most sensitive over the long term and set priorities for upgrading its protections.
French public authorities are preparing for the transition
For public authorities, Europol recommends mapping the use of encryption, prioritizing information that must remain confidential for many years and testing new security measures. This process needs to account for existing systems, communications between departments and infrastructure whose disruption would have significant consequences.
France has begun structured preparations for quantum-resistant cryptography. A national strategy and roadmap guide this transformation, while ANSSI is leading a migration plan organized into several stages through 2030. Measures are also being taken for critical infrastructure, whose security needs to be considered over its entire lifecycle.
This timeline reflects the scale of the task. Public authorities must anticipate technological developments that could materialize several years from now, while continuing to protect their systems against current attacks. The challenge is to select appropriate mechanisms, test how they work in relevant environments and plan their deployment without waiting until quantum decryption capabilities become available.
Identify the data that must remain confidential
The first step is to understand what information is held and how long it needs to be protected. Data that is temporarily sensitive is not the same as a medical record or a strategic secret whose disclosure could remain harmful for decades. This distinction helps direct efforts toward the assets most exposed to being collected and decrypted later.
Prepare systems to evolve
IT teams then need to identify the components that use cryptographic solutions that may need to be replaced. Testing can help assess whether new algorithms are compatible with existing applications, devices and communications. Planning can also include sufficiently flexible mechanisms to allow security measures to be changed as standards and needs evolve.
This preparation is in addition to efforts to combat existing cyber threats. Data theft, configuration errors, unauthorized access and software vulnerabilities still require immediate measures. The prospect of quantum computing does not make these risks secondary; rather, it requires organizations to protect their systems with both current attacks and the length of time stolen information must remain confidential in mind.
