On 3 September 2026, the G7 Cybersecurity Working Group — which includes the UK's National Cyber Security Centre — published a formal 'Call to Action' telling organisations to start migrating to post-quantum cryptography. The DCMS amplified it directly to UK businesses the same month.
Most coverage of this has focused on banks, critical infrastructure, and government systems. That's understandable, but it misses something important: the threat is already affecting your backup data, right now, whether you're a 30-person professional services firm or a 300-person manufacturer.
Here's what's actually happening, and what it means for UK SMBs.
The "Harvest Now, Decrypt Later" Problem
Nation-state actors — think organised, well-resourced groups operating on behalf of foreign governments — are not waiting for quantum computers to exist before they start collecting encrypted data. They're doing it now.
The strategy is straightforward: collect encrypted data today, store it, and decrypt it once quantum computing becomes capable enough to break current encryption standards. That window is estimated to open somewhere in the early-to-mid 2030s. It might be sooner.
What kind of data are they collecting? Anything they can get access to that looks valuable — and backup archives are a particularly attractive target. Backup data tends to be comprehensive. It contains everything: financial records, contracts, client data, IP, correspondence. And because backups are often stored for years, a single successful harvest can give an attacker a very long window into your business history.
The uncomfortable reality is this: the backup archives you're creating today could be fully readable by hostile actors within a decade. The encryption protecting them has an expiry date, and that date is approaching faster than most people realise.
The UK Government Has Set a 2028 Deadline
The NCSC hasn't just flagged this as something to think about eventually. It has set a concrete deadline: organisations should complete cryptographic discovery and planning by 2028.
Cryptographic discovery means knowing what encryption standards are in use across your systems — including your backup platform, your stored archives, and anything in transit. Planning means having a roadmap for migrating to post-quantum cryptography before current standards become vulnerable.
That gives UK SMBs less than 18 months to get to grips with their current position. That's not a long time, particularly if your IT team is already stretched.
Most SMBs Have No Plan at All
A 2025 ISACA survey found that 95% of organisations have no post-quantum cryptography plan in place. That's not surprising — this has mostly been treated as an enterprise or government concern — but it's a problem.
The good news is that the immediate ask for most SMBs isn't to rip out and replace everything overnight. It's far simpler than that. It starts with one question.
The Question Every IT Manager Should Be Asking Right Now
Ask your backup provider: what encryption standard protects our stored backup data, and is it on a migration roadmap?
If they can answer that clearly — if they know what algorithm is in use, whether it's on the list of standards the NCSC considers vulnerable, and whether they have a timeline for moving to post-quantum alternatives — that's a good sign. It means they're tracking this on your behalf.
If they look blank, or tell you it's not something they've thought about, that's worth knowing too. A managed backup provider that isn't considering post-quantum readiness is quietly building a long-term liability into your data protection arrangement.
You don't need to become an expert in cryptographic algorithms. But you do need to know that your provider is one.
What This Means in Practice for UK SMBs
To be clear: this isn't a reason to panic or to make rushed decisions about your backup infrastructure. Post-quantum migration is a process, and it takes time even for organisations that start today.
What it does mean is that doing nothing is no longer a neutral choice. If your backup data contains anything that needs to stay confidential over the next 5–10 years — client information, financial records, commercially sensitive material — then the encryption protecting it needs to be part of your thinking now, not later.
The G7 warning and the NCSC's 2028 deadline are designed to give organisations time to prepare properly. The SMBs that act in the next 12–18 months will be in a far stronger position than those that wait until it becomes urgent.
The first step is simply knowing where you stand.
Not sure whether your backup provider is thinking about post-quantum readiness? Talk to IronFell. We'll give you a straight answer about how your backup data is protected today — and what the roadmap looks like. No jargon, no hard sell.
Protect your business data.
Get a real, itemised quote in under 5 minutes — no sales calls.
Start protecting your data