Commentary Addressing Risks and Opportunities Through the Life Cycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

This is the second installment in a series examining quantum computing risk from a legal and compliance perspective. The <a href="https://www.bakerdatacounsel.com/blogs/what-in-house-counsel-should-know-about-quantum-risk-the-quantum-threat/" target="_blank" rel="noreferrer noopener">first post</a> covered the technical foundations. This post addresses the legal risks that follow from the quantum threat.

core/paragraph

Cryptographically relevant quantum computers (CRQCs) will be more than just a technological breakthrough. They will herald novel security risks and reshape legal risk across the data lifecycle. As discussed in our prior post, threat actors are already exploiting the underlying vulnerability through harvest-now-decrypt-later (HNDL) attacks, where sophisticated adversaries intercept encrypted telecommunications to prepare for later decryption. Thus, CRQCs will not only introduce new data security incidents, but could also retroactively alter the significance of an adversary’s past actions if they allow the adversary to decrypt previously compromised-but-encrypted data that remains sensitive over time. CRQCs will also introduce structural vulnerabilities in systems that rely on asymmetric cryptography, including identity infrastructure and blockchain networks. The threat of CRQCs is already reshaping incident response strategies, legal risk and the relevant standards of care.

This post examines how legal risks may arise and develop. It first addresses the types of data security incidents that will become possible or materially worse when CRQCs become available. Understanding these incident pathways is essential to identifying which compromises carry meaningful quantum exposure. It then turns to the legally novel dimension of retrospective risk, including how future decryption may reopen prior breach analyses and trigger new notification, litigation or insurance disputes. The post also examines systemic and hard-to-remediate risk in blockchain ecosystems and smart contracts, and concludes with the evolving regulatory standard of care as governments increasingly signal that organizations should begin preparing for quantum threats now.

New Data Security Incidents at the Arrival of CRQCs

core/heading

Organizations will face new legal risks as CRQCs become operational, commercialized and widely available. The most obvious risk is the potential for new, severe data security incidents as the tech ecosystem’s defensive layers break down if not first adequately protected by post-quantum cryptography (PQC). Systems at risk include:

Transport Layer Security (TLS). Attackers who intercept RSA- or ECC-encrypted HTTPS traffic – such as through BGP hijacking, compromised network infrastructure or rogue access points – could use CRQCs to decrypt the traffic. This includes secure web traffic, API calls and interactions with cloud services. Even forward-secret implementations of TLS (mandatory in TLS 1.3; optional in TLS 1.2) that rely on ephemeral key exchanges (like DHE or ECDHE) will be vulnerable because Shor’s algorithm could derive ephemeral private keys from publicly exchanged key material. In addition, breaking a certificate authority’s keys could allow attackers to forge TLS certificates for arbitrary domains, allowing man-in-the-middle attacks at scale.

core/list-item

Authentication systems. CRQCs could break digital certificates, PKI hierarchies and code-signing infrastructure that rely on RSA or ECC. This could enable attackers to impersonate other entities, issue fraudulent software updates or forge authentication tokens (e.g., JWTs or SAML assertions for SSO). Compromised SSH keys could enable direct server login, with no credential theft required.

VPNs and encrypted communications. CRQCs could break enterprise VPNs and secure messaging applications that depend on RSA- or ECC-based session key negotiation, exposing intercepted traffic.

Data at rest. Many enterprise cryptographic systems protect data with “envelope encryption”: generating a random file- or object-level symmetric encryption key, then locking that key using an RSA or ECC “wrapper” key. This structure is widely used by public-key cloud key management services, encrypted email, enterprise document protection and HSM-backed key transport systems. A threat actor who compromises both encrypted data and its wrapped key material could decrypt the data even where the underlying symmetric encryption would otherwise be quantum resistant. In addition, Grover’s algorithm theoretically reduces the effective security of AES-128. While practical quantum attacks against AES-128 will likely remain far more difficult than attacks against public-key cryptography, the contents of any system using AES-128 for long-term confidentiality – encrypted databases, archived files, backup storage or data at rest in cloud environments – could be at risk if compromised.

core/list

Collectively, these attacks pose serious threats to encryption vulnerable to CRQCs. But not every incident carries added risk in a post-quantum world. The incidents that present novel risk generally share a specific structural feature: The threat actor obtained not just encrypted data but also the asymmetric cryptographic material (i.e., the public key) from which decryption keys can be derived. This means the highest-risk incidents are those involving network-level interception of traffic (where the key exchange itself traversed the wire and can be broken by Shor’s algorithm), exfiltration of encrypted data alongside asymmetrically wrapped encryption keys (such as PGP-encrypted archives, S/MIME messages or cloud-stored objects with RSA-wrapped data keys) or theft of PKI public keys that anchor trust hierarchies.

By contrast, the majority of conventional data breaches present little or no added quantum risk. An attacker who exfiltrated a database in plaintext already has the data. An attacker who stole credentials or session tokens obtained access, not ciphertext. And an attacker who compromised an endpoint and downloaded files encrypted purely with AES-256 likely does not practically benefit from a quantum shortcut.

Legally, quantum-enabled incidents lend themselves to familiar risk frameworks. Unauthorized access to protected data, compromise of authentication systems, and loss of confidentiality or integrity are all relevant concepts. Over time, as the quantum threat becomes more widely discussed and the availability of PQC increases, courts and regulators will be more likely to view these incidents as foreseeable and preventable.

Contemplating CRQCs in Incident-Related Risk Assessments

As CRQCs approach maturity, organizations will need to increasingly consider their impact on incident-related risk assessments. Many global breach notification laws – such as the GDPR and many U.S. state laws – effectively do not impose notice obligations where data is encrypted with a secure algorithm. But these provisions generally apply only if the encryption algorithm and implementation are secure. When CRQCs reach maturity, the security afforded by certain encryption, in certain incidents, may be less certain, requiring entities to consider their risk assessments carefully.

The European Data Protection Board’s (EDPB) <a href="https://www.edpb.europa.eu/documents/guideline/guidelines-92022-on-personal-data-breach-notification-under-gdpr_en" target="_blank" rel="noreferrer noopener">guidelines on personal data breach notification</a> already point to this concern, noting that although “a confidentiality breach involving properly encrypted personal data may not need to be notified . . . because such a breach is unlikely to pose a risk to individuals’ rights and freedoms . . . this may change over time and the risk would have to be re-evaluated” – for example, “[i]f it later becomes evident that the encryption key was compromised” or that the underlying “encryption software or algorithm is vulnerable.”

The possibility of past incidents turning into newly actionable data breaches could also pose distinct cyber insurance risks.

Blockchain presents some of the most distinctive and difficult-to-remediate quantum risks. Many major public blockchains – including Bitcoin and Ethereum – rely extensively on ECC using the secp256k1 curve. A CRQC running Shor’s algorithm could derive private keys from exposed public keys. Ethereum’s consensus layer also relies on BLS12-381 signatures, while its scaling infrastructure uses KZG polynomial commitments, both of which are independently vulnerable to Shor’s algorithm.

Addresses where the public key is already visible on-chain will be vulnerable as soon as CRQCs are available. On-chain public key visibility occurs when, for example, an address is used to send a transaction, exposing the public key, and then reused. It also affects addresses that were used to receive a transaction in the early days of cryptocurrency with Pay-to-Public-Key transactions. A recent Google <a href="https://quantumai.google/static/site-assets/downloads/cryptocurrency-whitepaper.pdf">whitepaper</a> estimates that approximately BTC 6.9 million (approximately USD 500 billion) are held in vulnerable addresses. Unlike the classic HNDL threat, where an adversary must have already intercepted data in transit, the permanence of the blockchain ledger means no prior access is required. Exposed public keys are already publicly archived, available to any post-Q-Day attacker.

Addresses that have not yet exposed their public key remain protected until they initiate a transaction. However, recent research indicates that CRQCs could eventually break ECC-256 in a matter of minutes – potentially within Bitcoin’s 10-minute block time, enabling real-time “on-spend” attacks on otherwise protected addresses.

Smart contracts present an additional layer of risk. Smart contracts are self-executing code deployed immutably to a blockchain. They generally cannot be modified once deployed, unless they include a built-in, deliberate upgrade mechanism. Smart contracts that rely on ECDSA-based signatures for authorization may be exploited through quantum-derived private keys, allowing attackers to impersonate users and execute unauthorized transactions, with no ability to remediate retroactively. And many contracts designed to be upgradable rely on a proxy pattern in which a single, typically ECDSA-based administrator key allows for changes to the contract; if a quantum attacker derives that key, they can rewrite the contract’s logic.

Both Bitcoin and Ethereum are actively developing PQC migration strategies. Ethereum introduced a PQC <a href="https://ethereum.org/roadmap/future-proofing/quantum-resistance/">roadmap</a> in February 2026, targeting 2029 for full PQC protection. Bitcoin’s path is more constrained by its conservative governance model, with several proposals and an open-ended timeline.

Regulators already emphasize the importance of designing for CRQCs. In its <a href="https://www.edpb.europa.eu/our-work-tools/documents/public-consultations/2025/guidelines-022025-processing-personal-data_en" target="_blank" rel="noreferrer noopener">guidelines on blockchain</a>, the EDPB notes that “the possibility of technical advances such as cryptanalytically-relevant quantum computers, should be balanced with regard to the sensitivity and value of the data, and the risks to the data subject . . . . Such risk should be assessed in the design phase of the processing and should be part of the risk management process along the life cycle of the processing, including with periodic reassessment.”

From a legal perspective, quantum compromise of blockchain systems and smart contracts introduces familiar but unusually hard-to-contain risks: unauthorized transfers of digital assets, loss of confidentiality or control over wallets, and exploitation of application logic, all of which can trigger disputes, litigation and regulatory scrutiny. The key distinction is the limited ability to remediate, making loss allocation and recovery more complex than in traditional systems. These risks may also heighten diligence and disclosure obligations for organizations with significant blockchain exposure.

Data Protection Compliance and the Evolving Standard of Care

Independent of specific incident scenarios, the quantum risk landscape is reshaping the legal standard of care for information security. Various governmental bodies, including NIST, CISA, NSA, UK NCSC, EU NIS2 Cooperation Group and the Canadian CCS, have issued guidance on PQC migration and the deprecation of quantum-unsafe methods. This guidance will inform how courts and regulators conceptualize requirements to implement and maintain reasonable and appropriate security measures. They establish that the quantum threat is known, mitigations exist and preparation should begin now.

More recently, <a href="https://www.whitehouse.gov/presidential-actions/2026/06/securing-the-nation-against-advanced-cryptographic-attacks/" target="_blank" rel="noreferrer noopener">Executive Order 14,412</a>, “Securing the Nation Against Advanced Cryptographic Attacks,” frames PQC migration as a current national cybersecurity priority, setting accelerated timelines for the transition of certain high-value federal assets and directing the development of a new requirement for federal contractors to be compliant with NIST PQC standards by the end of 2030.

Increasingly, regulators also are making clear that quantum risk should be considered throughout the data and software development life cycles, not just after incidents. For example, the EDPB’s <a href="https://www.edpb.europa.eu/our-work-tools/our-documents/recommendations/recommendations-012020-measures-supplement-transfer_en" target="_blank" rel="noreferrer noopener">recommendations on supplementary measures for cross-border data transfers</a> expressly observe that quantum computing is likely to threaten public key algorithms in common use, and that data exporters should consider the risk of HNDL strategies. The EDPB concludes that quantum-unsafe encryption should only be considered an effective supplementary measure to safeguard cross-border data transfers if, on Q-Day, the decryption and processing of the transferred data would no longer infringe on the rights of data subjects.

The legal risks from quantum computing start now and will play out over the coming decades. They span a continuum: from HNDL exposure today to potential retrospective concerns and future incidents. Regulatory frameworks are beginning to engage with these issues, although they are far from settled. This creates both uncertainty and risk for organizations. But proactive organizations also have the opportunity to influence how governments and regulators approach the quantum landscape, and to preemptively establish legally defensible positions.

We help clients identify and assess the varied and emerging legal risks associated with quantum computing facing their organizations, and we welcome the opportunity to discuss how these issues may apply to your unique situation. In the next installment, we will cover concrete actions organizations should take now.

What In-House Counsel Should Know About Quantum Risk: Legal Risks