Ho Chi Minh City Experts assess that the risk of "collect now, decode later" data using quantum computers is increasing, requiring Vietnam to prepare a response plan soon.

"When sufficiently powerful quantum computers are born, the previous classical encryption algorithms will face challenges. Financial systems, banks, public services and essential digital infrastructure will face the risk of being completely cracked," Mr. Le Quoc Cuong, a member of the Subcommittee on Science, Technology, Innovation and Digital Transformation of the Ho Chi Minh City Development Council, advised at the event Data safety and network security in the quantum era on the sidelines of the Fall Economic Forum this year. 2026 (AEF 2026) chaired by Ho Chi Minh City People's Committee.

Quantum computers use the principles of quantum mechanics to process and store information. Unlike traditional computers that use binary bits (0 or 1), quantum computers use qubits - information units that simultaneously exist in both 0 and 1 states. Thanks to that, the system can perform many calculations at the same time and solve complex problems that classical computers need many years to process.

According to Mr. Cuong, the activity of collecting encrypted data to wait for future decryption (Harvest Now, Decrypt Later) is taking place globally. Key areas such as national defense, public administration, healthcare, transportation, energy and banking transaction systems, especially in the financial center of Ho Chi Minh City, face the risk of data being collected and stored for decoding when quantum technology is capable of processing it.

Faced with that threat, he believes that transitioning to post-quantum cryptography (PQC) is no longer a preparation for the future, but has become an urgent requirement to protect data, national digital sovereignty and urban safety.

Sharing the same opinion, Mr. Stephen Oh, Vice President and Chief Technology Officer of Korea Quantum Computing (KQC), assessed that the current reality is that most existing encrypted data can be collected and stored, especially digital signatures, which are used by more and more organizations and individuals. Later, when quantum computers gain enough power, they can crack all classical encryption algorithms.

"This risk is especially serious when incorporating AI," Mr. Oh commented. "Upcoming social and economic activities will depend greatly on AI agents that operate on many digital signatures. Within the next 10 years, or even sooner, these digital signatures will be overcome by quantum computers."

According to the Vice President of KQC, previously experts predicted that the time for quantum computers to crack encryption would be around 2035. However, the actual speed is much faster. Quantum cryptographic algorithms are already available in the industry and timescales are shortening.

"We don't know exactly when that time will come, but we need to prepare from today. When the threat appears, it may be too late," he emphasized.

This expert said, cryptographic switching is not simply replacing one algorithm with another. This process involves the entire technology infrastructure, from user authentication, digital certificates, key management to connections between systems and service providers. A large system may require years to evaluate, test, and transition. Therefore, waiting until quantum computers reach practical attack capabilities before deploying will cause organizations to face the problem of not being able to protect data in time.

During the discussion session, experts also said that, despite awareness of quantum risks, the ability to deploy is still a worrying issue at many banks, businesses and regulatory agencies.

The banking sector is assessed to need to pay more attention to quantum risks. According to Mr. Priyesh Panchmatia, Director of solution consulting i-Sprint Innovations, banks and large businesses in Vietnam have begun to pay attention to quantum security, but have not been equally prepared. Some proactively research the risk of future attacks, but many organizations have difficulty evaluating the cryptographic systems in use, determining their level of readiness, and deciding on the necessary investments.

In addition, core banking systems, payment gateways, hardware security devices, and key management platforms may all contain cryptographic components that need to be reviewed. Depending on multiple suppliers also makes the transition process more complicated.

"We already have awareness of the threat, but we still need more motivation from policy and regulatory agencies to really start implementing," Mr. Panchmatia said.

To begin the transition, organizations need to identify the cryptographic components they are using, assess the risk, and plan for replacement. However, based on the experience of cryptographic migration at several financial institutions in Singapore, Mr. Panchmatia said inventory and testing should take place in parallel.

"You can't protect what you can't see, nor can you fix what you haven't identified," he explained. "A cryptographic inventory is a necessary step, but organizations should not wait for this process to be complete across the entire infrastructure before starting testing."

From there, Mr. Panchmatia believes that each organization should choose a key system as a pilot project. With banks, it could be an online banking platform or a payment gateway. The scope of the test should be wide enough to reflect real-world problems. In addition to encryption algorithms, organizations must review related components such as authentication mechanisms, digital signatures, connection security protocols, digital certificates, certificate authorities, key management devices, and connection interfaces with external providers.

According to Dr. Vo Van Tuan, Director of the Quantum Research Project (Quantum Lab) at FPT's Quantum Artificial Intelligence and Cyber ​​Security Research Institute (QACI), training programs should be designed according to each job position. Specifically, system architects need to understand how to evaluate and redesign infrastructure; Programmers need to understand how to integrate new algorithms into software; Auditors must be able to assess compliance and identify risks during the transition process.

Regarding the specific characteristics of Ho Chi Minh City, Mr. Cuong raised four groups of issues: building a testing mechanism (sandbox) for post-quantum cryptography and quantum communication technology; establish safety standards for telecommunications infrastructure and data centers to ensure quantum resistance in the next 5-10 years; complete policies on commercialization, technology transfer and support for start-up businesses; Build a remuneration mechanism to attract leading experts in cybersecurity and quantum cryptography to work in the city.

According to Mr. Cuong, the immediate roadmap includes designing the system according to the principle of crypto agility, allowing upgrading to post-quantum cryptography when international standards are officially issued. At the same time, it is necessary to audit data security risks in key areas such as finance, banking and Ho Chi Minh City Electronic Information Portal.

AEF 2026 will be held at Thiskyhall Sala Convention Center, Ho Chi Minh City, starting side sessions from October 26, before officially opening on October 28. One of the goals of the forum is to focus on discussing issues shaping new growth drivers such as breakthrough technology, digitalization, greening, finance, value chains and new cooperation models. According to the Organizing Committee, Ho Chi Minh City is not just a destination, but aims to become a place where global resources meet, are coordinated and transformed into investment decisions. At the same time, this will be the destination of international cooperation initiatives, a center connecting emerging economies and a focal point for promoting regional innovation.

Bao Lam