Your Encrypted Backups Are Already Stolen
Assume a copy of your encrypted archive left your network at some point in the last five years. Not because you were careless, but because that is the base rate now.
The question this raises is not whether the attacker can read it today. They cannot. The question is what happens over the lifetime of the data inside it.
Ciphertext does not expire, and neither does patience
An encrypted file that leaves your control enters an archive somewhere. Storage costs almost nothing, so there is no pressure to delete it, and no cost to waiting. The attacker's position is a free option with no expiry.
The value of that option depends on one variable: how long the data stays sensitive.
- A session token is worthless in an hour.
- A card number is worthless after reissue.
- A passport scan is valid for a decade, and identifies the same person forever.
- A medical record does not stop being sensitive, ever.
For the first two, encryption is a fine bet. For the last two, you are betting a specific cipher and a specific key length against a horizon that includes cryptanalysis nobody has published yet and hardware nobody has built yet.
The bet is not unreasonable, it is just a bet
AES-256 is in good shape. Grover's algorithm reduces its effective strength to roughly 128 bits, which remains beyond reach. There is no credible public path to breaking it.
That is the correct read of the evidence today. It is also exactly what a well-informed person would have said about every primitive that was later retired. The point is not that AES will fall. The point is that "will not fall within thirty years" is a forecast, and you are making it on behalf of someone whose passport you are holding.
Public-key cryptography is in a different position. Shor's algorithm breaks RSA and elliptic curves outright rather than weakening them, which is why post-quantum migration is a live engineering program rather than a thought experiment.
What actually changes the outcome
If you accept that the archive left, the useful question becomes: what did it contain?
If it contained a complete encrypted file, it contained everything, pending one future event.
If it contained fewer than K shards of a threshold-split file, it contained nothing. Not weakly protected data. Nothing. Below the threshold, the missing information was never written into the shares, so there is no future computation that recovers it. A quantum computer has nothing to point at.
That is the difference between a system whose security decays with time and one whose security does not.
The practical version
You cannot un-exfiltrate the archives that already left. What you can change is what the next one is worth.
For data with a multi-decade sensitivity lifetime, the property to look for is not a stronger cipher. It is that no single location ever held the complete object, so no single theft ever took it.
Further reading: Post-Quantum and Harvest Now, Decrypt Later and Why Encryption Is Not Enough.