QLogs 3220 MIX May 1, 2025: 134,633 US Credentials in the Operator’s Largest Early Harvest

134,633 Records: The QLogs 3220 MIX and the Operator's Largest Early Harvest

On May 1, 2025, the QLogs operator assembled its most ambitious collection to date: 3,220 files from infected US endpoints, yielding 134,633 credential records. Released May 17 after a 16-day staging window, the QLogs 3220 MIX stands as the largest single batch by file count in the early QLogs series. The 3,220 figure itself is highly irregular -- no standard QLogs batch size comes close -- and likely reflects whatever the infostealer network delivered during a particularly active harvesting period rather than a curated, pre-determined batch size. The scale is notable, but the yield tells a more nuanced story.

QLogs 3220 MIX (May 2025): Stealer Log Summary

• Records Exposed: 134,633
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: May 17, 2025

~41.8 Records Per File: Volume Over Density

At approximately 41.8 records per file, the 3220 MIX yield is respectable but not exceptional for the QLogs series. The MIX designation signals a heterogeneous endpoint pool -- no strict targeting by consumer profile or enterprise affiliation -- which inherently limits per-file density compared to focused PCS harvests. For a batch of this scale, the trade-off is clear: the operator sacrificed yield per endpoint in exchange for sheer volume. The 134,633 total records make this the highest absolute record count among early QLogs releases, even if per-file metrics lag behined the contemporaneous PCS batches that would emerge in mid-May.

16-Day Staging: Between the Long Holds and the Rapid Drops

A 16-day gap between May 1 collection and May 17 release places the 3220 MIX batch squarely in the mid-staging era of QLogs. The April batches held for ~27-31 days. By mid-May, releases like QLogs_Offical 360 MIX would ship same-day. The 16-day window on this batch suggests the operator was still working through a processing or distribution queue, possibly reviewing a harvest this large before pushing it out. At 3,220 files, there may have been more manual verification required before the batch was cleared for release -- or the sheer size simply took longer to package and upload through the operator's infrastructure.

3,220 Files: What the Scale Reveals About the Network

The 3,220-file count is the most direct indicator of the QLogs operator's reach at this point in May 2025. Assembling over three thousand infected US consumer endpoints in a single harvest window requires a substantial infostealer botnet -- or access to a large credential aggregation network that pulls from multiple sources. For context, standard QLogs batches in later months would cap at 2,500 files. The 3,220 count suggests either a particularly productive May 1 infection wave, an aggregation of files from multiple collection sessions compressed into a single batch, or both. Whatever the mechanizm, the scale confirms the QLogs operation was operating at significant reach by early May 2025.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records -- including large-scale MIX batches like the QLogs 3220 MIX from May 2025. A scan at HEROIC's breach scanner will tell you immediately whether your credentials were among the 134,633 exposed in this batch.