QLogs 500 PCS Jun 22, 2025: 22,379 US Records From the Pre-VIP Era

Before VIP: QLogs 500 PCS Jun 22 Delivers 22,379 US Records Without the Premium Label

The batch "QLogs 500 PCS 22-06-2025" is the second of three consecutve same-day PCS releases spanning June 21-23, 2025 -- a cluster of early QLogs releases that uniformly lack the VIP designation applied to qualifying batches from June 26 onward. At 22,379 US credentials across 500 files, the per-file yield of approximately 44.76 records exceeds what would later become the VIP threshold (~38-40 rec/file), yet no VIP label was applied. The evidence now points to a clear conclusion: the VIP tier for PCS batches was not established until around June 26, and the Jun 20-23 batches predate that framework entirely regardless of yield quality.

QLogs 500 PCS (June 22, 2025): Stealer Log Summary

• Records Exposed: 22,379
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: June 22, 2025

The Jun 20-23 Non-VIP Cluster in Context

Across four consecutive days in late June, the QLogs operator released same-day PCS batches without VIP designation: Jun 20 (500 PCS, ~41.4 rec/file), Jun 21 (300 PCS, ~50.6 rec/file), Jun 22 (500 PCS, ~44.8 rec/file), and Jun 23 (1000 PCS, ~53.2 rec/file). The yields are high enough to qualify for VIP under the framework applied from Jun 26 onward -- particularly the Jun 23 batch at 53.2 rec/file. The uniform absence of VIP labeling across all four suggests the operator was distributing these as a pre-tier format, possibly testing the PCS distribution channel before formalizing the VIP designaton system. The transition is sharp: Jun 24 brings VIP 2500 MIX, Jun 26 brings VIP 1500 PCS, and VIP is applied consistently to PCS batches thereafter.

Plaintext Passwords From Early-Series Harvests

Despite the lack of VIP designation, the Jun 22 batch carries the same type of data as all QLogs PCS releases: plaintext email-password pairs harvested from malawre-infected Windows endpoints via browser credential store extraction. The absence of a premium label does not reduce the operational value of the credentials for threat actors -- 22,379 US plaintext passwords are immediately deployable in credential stuffing tools without any post-processing. The early-series batches from Jun 20-23 likely reflect the same infection campaign infrastructure as the subsequent VIP-labeled releases, just distributed before the operator formalized their tier naming convention.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records to tell you whether your email address or password has appeared in stealer log datasets, including early-series releases like this one. The absence of a VIP label does not mean less risk -- 22,379 plaintext passwords are immediately usable in credential stuffing attacks. Search your email at HEROIC's breach scanner and update any matched passwords immediately.