QLogs VIP 500 PCS Jun 27, 2025: 41,190 US Records at a Series-High 82.38 Rec/File

Series Peak: QLogs VIP 500 PCS Jun 27 Delivers 41,190 US Records at 82.38 Rec/File

On June 27, 2025, the QLogs operator released what would become the highest per-file yield batch observed in the entire 2025 dataset: 41,190 US credentails across 500 stealer log files, equating to approximately 82.38 records per file. This figure is roughly double the standard VIP PCS yield of 40-50 rec/file, and materially exceeds even the near-record batch from July 3-4 at ~79.76 rec/file. The batch was published the day after the 1,500-file VIP PCS Jun 26 release -- suggesting that June 27 was not a casual publishing date but rather part of an active high-volume distribution event spanning consecutive days in late June 2025.

QLogs VIP 500 PCS (June 27, 2025): Stealer Log Summary

• Records Exposed: 41,190
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: June 27, 2025

82.38 Rec/File: Three Explanations for the Series Peak

The June 27 batch stands at the top of the QLogs yield curve for 2025. Three hypotheses account for the exceptional output. First, endpoint selection: this batch may target a demographically distinct user group -- power users, frequent online shoppers, or professionals with extensive browser-saved credential libraries. A single endpoint with 100+ saved passwords versus a typical endpoint with 30-40 would dramatically skew the per-file average upward. Second, infostealr variant: not all stealer malware scans the same credential sources. A variant capable of extracting from desktop password managers, autofill databases, and OS-level keystores alongside browser vaults could harvest three to four times the credentials per endpoint compared to browser-only stealers. Third, multi-session aggregation: the operator may have combined credential captures from the same endpoint across multiple malware executions, stacking records per file without increasing the raw endpoint count proportionally.

Late-June Cluster: Jun 26-27 as a High-Volume Distribution Window

The June 26 and June 27 releases together constitute the most active two-day window in the QLogs 2025 dataset: a 1,500-file VIP PCS batch on June 26 (74,458 records, ~49.6 rec/file) followed immediately by a 500-file VIP PCS batch on June 27 (41,190 records, ~82.38 rec/file). The combined output over two days -- 115,648 US credentials, 2,000 files -- exceeds the single-day output of any other QLogs release window observed. The operationl implication is that the QLogs pipeline was running at or near peak capacity in late June 2025, pushing through a backlog of high-quality harvests before the July daily-cadence same-day releases began.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records to check whether your email address or password has appeared in stealer log datasets, including this series-high batch. At 82.38 rec/file, this release is among the most credential-dense packages in the 2025 QLogs series -- a ready-made corpus for credential stuffing campaigns. Search your email at HEROIC's breach scanner and update any matched passwords immediately.