Europol Warns Financial Sector of “Imminent” Quantum Threat

Europe’s financial services sector must begin planning now for the transition to quantum-safe cryptography, as the risk of “store now decrypt later” (SNDL) attacks grows, Europol has warned.

The policing group issued the calls at its Quantum Safe Financial Forum (QSFF) event on Friday.

Quantum computers are expected in time to be able to break public key cryptography (asymmetric encryption), which is how global financial transactions, authentication processes and digital contracts are currently secured.

Although those machines are still thought to be at least a decade away, SNDL attacks compress this timeline if threat actors are already stealing sensitive data with a view to decrypting it later when quantum capabilities are available.

Read more on quantum computing: UK Joins Quantum Arms Race with First Computer

It’s also possible that as more funding pours into the field, scientific breakthroughs accelerate the emergence of so-called “cryptographically relevant quantum computers” (CRQCs)

With this in mind, Europol’s QSFF made five recommendations in its closing Call to Action document:

• Financial institutions and policymakers should prioritize a transition to quantum-safe cryptography
• Coordination between different stakeholders must improve, including the alignment of roadmaps, goals and implementation strategies
• A voluntary framework established between regulators and private sector will be enough to drive quantum-same initiatives and standardization
• A forward-looking framework to cryptography management is needed
• More cross-border collaboration and knowledge sharing between public and private sector bodies is also essential

Last year, the US National Institute of Standards & Technology (NIST) formally announced the first three “quantum-safe” algorithms, releasing them as official post-quantum cryptography standards.

The UK’s banking industry has already warned of the threat from CRQCs and, back in 2023, outlined a set of recommendations urging government to kickstart the journey to quantum safety.

Financial services remains a popular target for threat actors. A Contrast Security report last week revealed that 64% of banks had experienced attacks over the previous year, with more than half (54%) claiming data was destroyed by adversaries.

While waiting for CRQCs to emerge, organizations are urged to run new encryption standards alongside traditional ones for a time, in order to smooth the transition.