HEROIC Analysts Found a 43,735-Record Breach: QLogs_Offical 900 MIX

Near-VIP MIX Yield: The QLogs_Offical 900 MIX May 12 Batch

At approximately 48.6 records per file, the QLogs_Offical 900 MIX collected May 12, 2025 is one of the highest-yielding MIX batches in the early QLogs series -- rivaling yields that would later be reserved for VIP-labeled releases. The batch delivered 43,735 US credential records from 900 files and was released on May 13, just one day after collection. Its companion batch from the same date -- the QLogs_Offical530 MIX -- achieved a lower ~39.6 rec/file, making the 900 MIX the standout performer of the May 12 dual-release. Together, they exposed 64,744 US credentials from 1,430 endpoints in back-to-back drops.

QLogs_Offical 900 MIX (May 2025): Stealer Log Summary

• Records Exposed: 43,735
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: May 13, 2025

~48.6 Records Per File: High-Quality MIX Endpoints

MIX batches in the QLogs series draw from heterogeneous endpoint pools -- no strict targeting by consumer category or enterprise affiliation. Standard MIX yields typically fall in the 37-42 range. The 900 MIX at ~48.6 rec/file significantly exceeds that baseline, indicating the May 12 collection net had pulled in a particularly credential-dense set of endpoints. These are likely US consumers with deep browser credential stores: multiple email accounts, financial services, streaming, social media, and e-commerce logins all stored and all extracted in plaintext. A yield this high, for a MIX batch, suggests either refined targeting that wasn't formally labeled as PCS or a particularly successfull infection wave on mid-credential-density consumer endpoints.

1-Day Turnaround: The Accelerating QLogs Pipeline

The May 12 collection and May 13 release represents a 1-day staging window -- a dramatic contrast to the 27-31 day holds seen on April batches just two to four weeks earlier. By mid-May, the QLogs operator had clearly established a functional, near-real-time distribution pipeline. The companion 530 MIX from the same collection date leaked on May 14 -- just one day later -- suggesting both batches were processed simultaneously and released in rapid succesion. This acceleration would continue into June, where same-day releases became the norm.

The May 12 Dual-Drop: Two Batches, One Collection Day

The QLogs_Offical 900 MIX and QLogs_Offical530 MIX were both harvested on May 12 and released within 24 hours of each other. Their different file counts (900 vs 530) and yields (~48.6 vs ~39.6 rec/file) suggest the operator segmented the May 12 harvest into two distinct archives -- possibly by source quality, time of collection, or geographic sub-grouping within the US. The higher-yield 900-file batch clearing faster (May 13 vs May 14) may reflect a prioritization of the more valuable content, or simply reflect the order in which packaging was completed.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records -- including early-phase QLogs_Offical MIX batches like this high-yield May 12 collection. Run a scan at HEROIC's breach scanner to find out whether your credentials were among those exposed.