Miami, Florida
Qtonic Quantum Corp today published a public research report on harvest-now decrypt-later (HNDL) exposure in global football. It arrives on the opening day of a World Cup that is likely to generate one of the most concentrated bursts of cross-border medical and registration-related data transfers in the sport’s calendar.
The 30-page report, prepared by the Qtonic Quantum Research Team, analyzes why cardiac, medical, and identity records collected under FIFA’s mandatory programs are structurally different from almost any other category of enterprise data when measured against published quantum-cryptanalysis timelines. A compromised password is rotated and a compromised card is reissued. A decrypted cardiac record, and any biometric elements present in an identity record, cannot be.
The report is a public-evidence structural risk analysis with disclosed evidence boundaries. It does not allege any breach, and it makes no claim about FIFA’s internal security planning. As its cover states, we do not claim to know whether FIFA has a post-quantum plan. The analysis shows why the risk is material, time-sensitive, and, once encrypted traffic has been harvested, beyond remedy.
KEY FINDINGS
- Since 2010, FIFA has mandated pre-competition medical assessment for its competitions, with no opt-out. Identity and registration records for players across all 211 member associations are concentrated through FIFA Connect, while medical and PCMA-related data moves across borders through documented competition, transfer, and medical-governance workflows.
- This data crosses borders routinely over fiber-optic infrastructure documented in published reporting as subject to bulk intelligence collection. Encrypted traffic harvested today can be stored cheaply and decrypted when a sufficiently capable quantum computer arrives. A player screened at age 22 in 2024 will be 58 in 2060, and the data collected about that player will still be sensitive.
- Published resource estimates for quantum attacks have fallen sharply within each problem class. A peer-reviewed 2019 estimate put an attack on RSA-2048 at roughly 20 million physical qubits. By 2025 the same author’s update was under one million. For elliptic-curve cryptography, March 2026 preprints still pending peer review put plausible attacks below half a million physical qubits, and in one case in the tens of thousands. The report’s thesis does not depend on the newest figures. It stands on the peer-reviewed baseline and the lifetime sensitivity of the data.
- The timeline is institutional, not theoretical. Draft NIST guidance targets deprecation of quantum-vulnerable public-key algorithms, including RSA and ECDSA, for US federal systems around 2030, and Google has set a
2029 internal deadline for its own migration. Enterprise migrations of this kind historically take two to five years, which makes the runway question immediate. - The report documents a pattern with few parallels in other sectors: professional footballers whose data is collected during their playing careers and who later enter national political office, including at head-of-state
level. A documented example is George Weah, FIFA World Player of the Year in 1995 and President of Liberia from 2018 to 2024. The report makes no statement about any named individual’s data. - To the Research Team’s knowledge, and within a disclosed search methodology re-run on the date of publication, no major football governing body has publicly announced a post-quantum migration program. The report assigns a qualitative HNDL Risk Rating of Critical and recommends a cryptographic inventory as the first concrete step, an exercise that can begin immediately.
“Athletes and their managers should have an expectation that their personal and biometric data is treated with care. ‘Harvest now, decrypt later’ means they are already facing this issue.” — Richard H. “Rick” Ledgett, Jr., former Deputy Director and Chief Operating Officer of the National Security Agency, now a national security expert with Qtonic Quantum Corp.
“FIFA athletes and members deserve the highest level of personal data protection. The risks are growing, and quantum readiness can no longer wait. The time to act is now.”
— Dr. Shue-Jane L. Thompson, an enterprise security expert with Qtonic Quantum Corp and former Global Managing Partner at IBM Consulting.
The full report is available at qtonicquantum.com/fifa.
NOTES TO EDITORS
The report runs 30 pages and includes its search methodology, a three-tier evidence classification applied to every claim, source documentation, and an appendix stating the specific conditions under which its thesis would weaken. The search methodology behind the “no public announcement” finding is disclosed in full in Appendix B. It was re-run and timestamped on the date of publication, and independent replication is invited. Factual errors identified after publication will be corrected in subsequent versions and noted. A four-panel summary graphic, “The Risk in Four Views,” is available for editorial use on request. The report names individuals solely as publicly documented examples of athletes who later entered public life and makes no statement about any individual’s data or risk.
ABOUT QTONIC QUANTUM
Qtonic Quantum Corp provides quantum risk and vulnerability intelligence to enterprises and governments, including cryptographic discovery, quantum-risk analysis, and post-quantum migration support. The company is headquartered in Miami, Florida. Post Quantum Ready.
Qtonic Quantum Corp offers commercial services in the field this report addresses, and the report discloses that interest.
MEDIA CONTACT
Qtonic Quantum Research Team
info@qtonicquantum.com
+1 (866) 4-QTONIC
qtonicquantum.com/fifa