The Hong Kong Monetary Authority launched a Quantum Preparedness Index for banks in 2026. Financial institutions are scrambling to map their cryptographic assets. But what about the social services sector? The NGOs, the welfare hotlines, the public housing databases, the elderly care networks. When a quantum computer eventually breaks the encryption that protects client records and subsidy payments, will Hong Kong’s most vulnerable populations be left exposed?

This is not a distant science fiction problem. The threat is called “Harvest Now, Decrypt Later.” Adversaries are already scooping up encrypted data today, waiting for the day they can unlock it. For a sector that holds decades of sensitive case files, the clock is ticking.

The Quantum Threat Is Closer Than You Think

Let us clear something up. A fully fault-tolerant quantum computer that can break RSA-2048 encryption is not here yet. Experts estimate it is still a few years away. But the planning horizon for post-quantum cryptography (PQC) migration is long. The Hong Kong banking sector has been told to reach full readiness by 2030. That gives organisations about four years to inventory their encryption, test new algorithms, and upgrade systems.

Social services often operate on older IT infrastructure. A case management system running on a five year old server might use encryption that is perfectly fine today. But if that data is still sensitive in five years, it is at risk. Think about the personal data held by the Social Welfare Department or a major charity like the Hong Kong Red Cross. Addresses, identity card numbers, medical histories, bank account details for subsidy disbursement. That data needs to stay confidential for decades.

Why Social Services Are Especially Vulnerable

The banking sector has deep pockets and regulatory pressure. The HKMA is actively pushing banks toward PQC. Social services do not have the same level of oversight. Many NGOs operate on tight budgets. Their IT teams are small. Their priority is service delivery, not cryptographic agility.

Here is a snapshot of the readiness gap:

Area	Banking Sector	Social Services Sector
Regulatory mandate	HKMA Quantum Preparedness Index	None
Cryptographic inventory	Underway for most major banks	Rarely conducted
Budget for PQC migration	Allocated	Not allocated
Vendor engagement	Active discussions with tech providers	Minimal awareness
Timeline	Target 2030	No target set

This gap is dangerous because social services hold some of the most sensitive data about the most vulnerable people. A data breach that leaks the records of a domestic violence shelter or a foster care programme could cause real harm.

What “Harvest Now, Decrypt Later” Means for Your NGO

You might think your data is safe because it is encrypted. That is true for now. But here is the problem. Encrypted data can be stolen and stored. When quantum computers become powerful enough, that stolen data can be decrypted retroactively.

Consider a charity that processes rental assistance applications in Wong Tai Sin. Every application includes a copy of the applicant’s Hong Kong identity card and proof of income. If that data is harvested today and decrypted in 2030, the information is still valid. Identity cards do not expire that fast.

This is not a hypothetical risk. Nation-state actors are known to collect encrypted data for future decryption. Social service databases, because they are often less protected than financial systems, could become attractive targets.

A Practical Roadmap for Your Agency

So what do you do about it? You do not need to become a quantum physicist. You need to start with practical steps. Here is a numbered list of actions your organisation can take this year.

1. Conduct a cryptographic inventory. Find every place your organisation uses encryption. This includes databases, email systems, virtual private networks, and any third party software that handles client data. You cannot protect what you do not know about.

2. Talk to your vendors. Ask your software providers about their post-quantum plans. Are they testing new algorithms from the National Institute of Standards and Technology (NIST)? Do they have a timeline for PQC support? If they cannot answer, that is a red flag.

3. Join the conversation. The Hong Kong cybersecurity community is starting to form working groups around PQC. Organisations like HKCERT and the HKMA are sharing resources. Social service IT directors and tech policy analysts should be in those rooms. Your voice matters.

4. Prioritise long-lived data. Some data needs to stay secret for a long time. Medical records, legal case files, and donor information are examples. Focus your migration efforts on systems that hold this type of data first.

5. Plan for cryptographic agility. When you buy new software or upgrade existing systems, ask if the encryption can be swapped out easily. You want systems that support algorithm agility, so you can update them without a complete rebuild.

Common Mistakes to Avoid

I have seen organisations make the same errors when preparing for new technology threats. Here are the pitfalls to watch for.

• Waiting for a standard to be finalised. NIST has already selected several PQC algorithms. You do not need to wait for the final versions. Start testing now.
• Assuming your cloud provider handles it. If you use a cloud platform for case management, check what encryption they use and whether they have a PQC plan. Do not assume.
• Ignoring legacy systems. That old database running on a server in a Sham Shui Po office might use obsolete encryption. It is a weak link.
• Focusing only on data at rest. Data in transit, like emails between social workers and clients, is also vulnerable. Encrypt your communications with quantum-safe protocols where possible.

What Quantum Computing Could Do for Social Services

It is not all doom and gloom. Quantum computing also offers opportunities for the social sector. The technology could eventually help with:

• Optimising resource allocation. Imagine a quantum algorithm that schedules home care visits for hundreds of elderly clients across Hong Kong’s districts, minimising travel time and maximising care hours.
• Improving fraud detection. Quantum machine learning could spot unusual patterns in subsidy claims much faster than classical systems.
• Simulating social policy outcomes. Digital twins of social systems could help policymakers test the impact of a new welfare policy before rolling it out.

But you cannot get to these benefits if your basic data security is compromised. The foundation has to be solid first.

“The cost of inaction is not a breach today. It is a breach five years from now, when the data you failed to protect becomes exposed. For social services, that is a trust crisis waiting to happen.”
Adapted from a 2026 briefing by a Hong Kong cybersecurity policy advisor.

Building Your Quantum Readiness Team

You do not need a large budget to start. What you need is a small team with clear ownership. Here is how to structure it.

• An IT lead who understands the current encryption landscape.
• A data governance officer who knows what data you hold and how long it needs to stay confidential.
• A vendor liaison who can communicate requirements to your software and hardware providers.
• An external advisor from a group like HKCERT or a university cybersecurity lab.

This team should meet monthly. Their first task is the cryptographic inventory. Their second task is to create a risk register that identifies which systems are most exposed to the harvest now, decrypt later threat.

For smaller NGOs that cannot spare a full team, consider partnering with a larger organisation. Some of Hong Kong’s biggest charities have IT departments that could offer shared services. There is also the option of using an external consultant for a one-time assessment. The cost is far lower than the cost of a data breach.

The Path Forward for Hong Kong

Hong Kong has a unique advantage. The city is small and connected. The banking sector is already moving. The government is paying attention. The social services sector needs to catch up, but it does not have to start from zero.

If you are a tech policy analyst, push for a cross-sector working group that includes social services. If you are an IT director in a public sector agency, start your inventory this quarter. If you are an academic, study the specific vulnerabilities of social service databases and publish your findings.

The question is not whether quantum computing will arrive. It is whether Hong Kong’s social safety net will be ready when it does.

Your Next Steps Start Today

Take a walk through your office. Look at the servers. Open the software settings. Ask your team what encryption they use. You might be surprised by what you find. The first step is awareness. The second step is action.

For more on how technology can transform your organisation’s operations, read our guide on If you are concerned about current cybersecurity threats, our article on https://idcc.hk/why-hong-kong-social-services-must-prioritize-cybersecurity-in-2026/ provides a broader view.

The quantum future is coming. Start preparing now, not because it is easy, but because the people you serve deserve protection that lasts.