Page 233 - Cyber Defense eMagazine RSAC Special Edition 2025

II. Introduction: The Quantum Horizon and Encrypted Data

Quantum computing presents a fundamental challenge. Its theorized capabilities cause concern because
they challenge the backbone of digital security and may render many if not all of our current encryption
standards obsolete. These concerns are further amplified due to the large amounts of encrypted data
already stolen via data breaches. In 2023, IBM estimated the average data breach involved 4.35 million
records, 83% of which included encrypted data. IBM also estimated that 83% of those breaches included
encrypted data. Such figures suggest over 10 billion encrypted records may be stolen annually. There
are likely several petabytes (1 petabyte = 1,000 terabytes) of encrypted data already stolen.

III. The Quantum Threat to Modern Cryptography

A. Principles of Quantum Computing

There are two key quantum mechanical phenomena, superposition and entanglement, that enable qubits
to operate fundamentally differently than classical bits. Superposition allows a qubit to exist in a
probabilistic combination of both 0 and 1 states simultaneously, significantly increasing the amount of
information a small number of qubits can hold. Entanglement, links the quantum states of two or more
qubits together in such a way that they become correlated, regardless of the physical distance separating
them. These capabilities allow quantum computers to explore a vast number of possibilities concurrently,
potentially offering exponential speedups over classical supercomputers.

IV. The Land of Encrypted Stolen Data
A. Today’s Common Encryption Methods Used

The vast majority of sensitive data is protected using prevalent encryption algorithms. Rivest-Shamir-
Adleman (RSA) and Elliptic Curve Cryptography (ECC) are widely employed for public-key cryptography.
Advanced Encryption Standard (AES) is a widely adopted symmetric encryption standard used to encrypt
large amounts of data.

B. Types of Sensitive Data Targeted

A wide range of sensitive data, including financial records, Personally Identifiable Information (PII),
intellectual property, and government secrets, is encrypted and stored by individuals, organizations, and
governments. This information is highly sought after by malicious actors for purposes such as financial
fraud, identity theft, corporate espionage, and compromising national security. Consequently, a market
exists on the dark web where various types of stolen data are sold at different prices. For instance,
personal data profiles can cost $10-$100, financial details like credit cards range from $5-$120,
compromised corporate databases can fetch $500-$100,000, and government credentials like passports
may sell for $500-$3,000, with prices varying based on the data's sensitivity and completeness.

233