Fifty Years of Trust, One Equation Away From Collapse

The encryption protecting your bank account, medical records, and university login has held for half a century. Quantum computing may be the first real threat to it — and the clock is already running.

By Bhawna Tyagi

In early 2026, university students across the country opened Canvas to submit finals papers and found it gone. Not down for maintenance. Gone, because a hacking group called ShinyHunters had broken into Instructure, the company behind Canvas, and walked away with names, email addresses, and student IDs belonging to thousands of university community members.

Losing access to Canvas mid-finals while knowing a hacker had your student ID was scary. What comes next is scarier.

ShinyHunters exploited a weak point in a company’s system. Frustrating, fixable. But a team of researchers from Manipal University Jaipur in India and Southern Federal University in Russia recently published a study called “From Pre Quantum to Post Quantum RSA” with a finding that is harder to shake. The team, Sandeep Joshi, Amit Kumar Bairwa, Pradumn Garg, Kshitij Agrawal, and Anton Pavlovich Pljonkin, tested how fast quantum computers could break the encryption protecting the internet compared to traditional computers. When they tripled the power of the quantum system, it solved the same problem roughly 1,000 times faster. That encryption is called RSA, a system invented in 1977 that scrambles data so only the intended recipient can read it, and that has protected bank accounts, medical records, and university logins for fifty years. According to what Joshi and colleagues found, that protection may be running out of time.

What Makes RSA So Hard to Break?

Think of RSA like a padlock with a very specific design. Anyone can snap it shut using a public key, which is openly available. But only the intended recipient holds the private key that opens it. The security does not depend on hiding the padlock. It depends on the fact that opening it without the right key is mathematically almost impossible.

That impossibility comes from prime numbers, whole numbers divisible only by one and themselves, like 2, 3, 5, 7, and 11. RSA works by multiplying two enormous prime numbers together to create a key so large it has 617 digits. Multiplying those primes together is fast. Reversing the process, starting with the key and working out the two original primes, would take a traditional supercomputer longer than the estimated age of the universe.

That difficulty is not a flaw in the system. That is the entire point. For fifty years, banking systems, healthcare records, email platforms, and university logins have all been built on the confidence that nobody could reverse that calculation fast enough to matter. What Joshi and colleagues set out to test was whether quantum computers were finally getting close enough to change that.

Why Are Quantum Computers Different?

Traditional computers process information one step at a time. Quantum computers work differently. They use units of information called qubits, which can exist in multiple states at once through a property called superposition. Think of it like a maze. A traditional computer tries one path at a time. A quantum computer can try every path at once. For most problems that advantage is modest. For the math RSA depends on staying hard, it is enormous.

In 1994, a mathematician named Peter Shor developed an algorithm that would allow a sufficiently powerful quantum computer to crack that math exponentially faster than any traditional system. For decades, Shor’s algorithm remained mostly theoretical because quantum hardware simply was not powerful enough to run it at any meaningful scale. Joshi and colleagues wanted to find out how theoretical it still was.

What Did the Study Actually Find?

To test Shor’s algorithm, the team ran it on IBM’s publicly accessible cloud quantum simulator and measured how long it took to crack the same problem at different levels of quantum power. The results, published in the 2023 Proceedings of the International Conference on Networking, Intelligent Systems and Security, were stark. At 32 qubits, the system solved the problem in 12,514 microseconds. At 100 qubits, the same problem took 12.4 microseconds. Tripling the power made the system roughly 1,000 times faster.

Joshi and colleagues were careful to note that the study used a simulator, not a full-scale quantum computer, and that the numbers they tested were far smaller than what protects real-world systems. Cracking actual RSA would require hardware far more powerful than anything currently available. But the trajectory those results document is what concerns experts. IBM has already released quantum systems exceeding 100 qubits, and its roadmap projects processors far more powerful in the years ahead. The hardware Joshi and colleagues tested is not a distant prototype. It is already online, available to anyone with an account.

Why Does This Matter Right Now?

The urgency Joshi and colleagues point to is not just about what quantum computers can do today. It is about a strategy called harvest now, decrypt later. Attackers can intercept and store encrypted data right now, even data they cannot yet read, and simply wait until quantum computers are powerful enough to decode it. A message sent today could be readable in ten or fifteen years.

A ten to fifteen year window is not abstract for a university student. It is the rest of their twenties.

Consider what data a university student generates: medical records at campus health services, financial aid information through FAFSA, academic transcripts, research data, personal emails. Each of those records can remain sensitive for decades. Data protected by RSA today could be sitting in an attacker’s archive right now, waiting for the hardware to catch up. That is exactly the scenario Joshi and colleagues are warning about, and according to their findings, the window to act is already closing.

Is Anyone Doing Anything About It?

The urgency the study documents is not isolated to one research team. In 2022, the National Institute of Standards and Technology, the federal agency that sets technology standards across the U.S. government, finalized its first standards for post-quantum cryptography, encryption systems designed to resist quantum attacks. The fact that a federal agency is already replacing cryptographic infrastructure tells you the threat has moved well past hypothetical.

That infrastructure replacement, however, will not happen overnight. Every bank, government agency, healthcare system, and university platform runs on systems built around RSA. Replacing all of it requires years of coordination across thousands of organizations. NIST’s new standards are a starting point, not a finish line.

The slow pace of that coordination is what makes the threat Joshi and colleagues identified fundamentally different from the Canvas breach. When Canvas went down, students noticed immediately and universities responded within days. The danger their study documents does not work that way. It builds gradually, through research papers, rising qubit counts, and expanding processor roadmaps, until one day the math protecting digital systems no longer holds the way its architects assumed.

That gradual build is exactly what Joshi and colleagues wanted to make visible. They did not just theorize about the possibility. They ran the experiment on public hardware, recorded the numbers, and published them. Their work does not answer whether quantum computing will break RSA. It asks whether the systems protecting everyone’s data will be ready before that question answers itself.

The next time Canvas goes down, it will probably be a routine outage, fixed within days the way the Instructure breach was. But the threat Joshi and colleagues documented does not announce itself the way a downed platform does. It builds quietly through rising qubit counts and falling factoring times, until one day the padlock that has protected student data since before most students were born no longer holds. The equation is getting closer to being solved. The question is whether the people responsible for protecting that data will be ready when it is.