QLogs.part1 1000 PCS Jun 8, 2025: 60,482 US Credentials Exposed in Split Stealer Log Release

When 2,000 Files Won't Fit in One Drop: The QLogs.part1 Split Release

On June 8, 2025, the QLogs operator did something it had never done before -- and hasn't repeated since. Instead of a single unified archive, the day's PCS harvest arrived in two seperate packages: QLogs.part1 and QLogs.part2. The first installment carried 1,000 files and 60,482 US credential records, delivered the same day they were collected. No staging window. No delay. Just raw infostealer output dropped directly onto the breach ecosystem within hours of harvesting.

QLogs.part1 1000 PCS (June 2025): Stealer Log Summary

• Records Exposed: 60,482
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: June 8, 2025

The Split Format: A Pipeline Anomaly in the QLogs Series

Across the entire QLogs operation, the part1/part2 split on June 8 stands alone. Every other release -- whether 300, 500, 1,000, 1,500, or 2,000 files -- arrived as a single archive. The Jun 8 harvest was apparantly too large or structurally incompatible with the operator's standard packaging pipeline, prompting the unusual decision to divide the 2,000-file collection into two 1,000-file drops. When the two parts are combined, the full picture emerges: 116,101+ records from 2,000 endpoints at roughly 58.05 records per file -- a yield that comfortably clears the threshold the operator would later associate with VIP-tier batches.

~60.5 Records Per File: Same-Day PCS at Near-VIP Yield

QLogs.part1 on its own averages approximately 60.48 records per file -- a figure that places it squarely in the high-yield tier for US PCS batches. The same-day release eliminates any staging window, suggesting these endpoints were either freshly compromised or had been queued for immediate publication rather than held for quality curation. Later VIP-labeled PCS batches in the series would regularly exceed 50 records per file, and this mid-June batch was already operating at that level -- without a VIP designaton. The absence of the label here is a chronological artifact: the VIP framework for PCS batches wasn't applied until late June 2025.

What "PCS" Means for Credential Risk

The PCS designation in QLogs batches refers to Personal Consumer Systems -- infected endpoints belonging to private individuals rather than corporate infrastructure. For credential defenders, this matters because consumer systems tend to store a broader mix of credentials: personal email accounts, banking portals, e-commerce logins, social media, and often reused passwords shared across many services. Each of the 60,482 records in this batch represents a real endpoint where infostealer malware extracted browser-stored credentials in plaintext. No decryption required. These credentials are immediately usable for credential stuffing, account takeover, and targeted phishing campaigns.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records -- including stealer log compilations like the QLogs series. If your email appeared in QLogs.part1 or any companion batch, you'll know immediately. Run a scan at HEROIC's breach scanner and take action before someone else does.