Pubx: 96,973 US Stealer Log Credentials (October 6, 2023)

Pubx: One Operator, One Release, 96,973 Credentials

On October 6, 2023, an operator identified as Pubx released a single stealer log batch containing 96,973 US credentials -- the single largest individual release from any operator that day. To put the scale in context: Monster Cloud, the most prolific Oct 6 operator, released 14 separate batches totaling 169,462 records; Pubx matched 57% of that with a single release. The Pubx drop accounts for roughly 24% of the ~400,000-record Oct 6 total, making it the dominant individual contribution to one of the largest single-day stealer log events in HEROIC's breach dataset. Pubx's aparent lack of multi-batch release history makes this scale all the more striking.

Pubx (October 2023): Stealer Log Summary

• Records Exposed: 96,973
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: October 6, 2023

The Oct 6 Multi-Operator Cluster: Coordinated or Coincidental?

Pubx was one of at least 14 distinct operators who released US credentials on October 6, 2023. Together, these operators contributed approximately 400,000 records -- a scale suggesting either coordinated timing or a shared upstream infection event that multiple actors were harvesting from simultaneously. Monster Cloud alone released 14 batches and 169,462 records that day, while operators like FortunaPrivate, SunCloudPubl, SatanFireLogs, PiratesLogs, and TG hulk_logs added tens of thousands more. Pubx dwarfed them all individually.

Scale Analysis: What 96,973 Records Means in Practice

At nearly 97,000 US credentials from a single stealer log release, the Pubx batch represents a significant pool for credential stuffing operations. Stealer log records include not only email/password pairs but also the specific URLs associated with each credential -- meaning attackers know exactly which services each victom used. A 96,973-record US dataset could contain credentials for banking portals, corporate VPNs, email providers, and e-commerce accounts. The plaintext nature of stealer log passwords means every single record is immediately actionable with no further processing required.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records, including stealer log datasets like Pubx. If your credentials were among the 96,973 US records in this release, your email address will appear in HEROIC's database. Don't wait for an account takover -- check now at HEROIC's breach scanner and secure any exposed accounts immediately.