QLogs VIP 500 PCS: 21,699 US Credentials Released Next Day After Collection (Jul 2025)

Next-Day Release: QLogs VIP 500 PCS Delivers 21,699 US Credentials With a 1-Day Staging Window

QLogs VIP 500 PCS 29-07-25 hit July 30, 2025 -- just one day after its July 29 collection date. Of all the QLogs US batches documented, this is among the fastest from harvest to market. The 21,699 US stealer log credentials it carries span 500 endpoint files at ~43.4 records per file -- a yield well above the MIX-tier average and consistent with the elevated rec/file ratios seen across other VIP PCS batches in the series. When a stealer log operator can move from endpoint compromise to credential distribution in 24 hours, the response window for affected users contracts to almost nothing.

QLogs VIP 500 PCS (July 2025): Stealer Log Summary

• Records Exposed: 21,699
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: July 30, 2025

The VIP PCS 500-File Format: A Recurring QLogs Release Unit

The 500-file VIP PCS batch appears repeatedly across the QLogs July 2025 series: July 13 (600 PCS), July 20 (500PCS), July 22 (500 PCS), and July 29 (this batch). The 500-endpoint packaging appears to be a deliberate release unit for the PCS tier -- small enough to package and validate quickly, but carrying higher yield per file than standard MIX batches. The VIP designation applied consistently across these 500-endpoint PCS batches suggests the operator views the PCS tier as premium when the per-file yield exceeds a certain threshold. At ~43.4 rec/file, this July 29 batch is the highest-yielding of the July 500-PCS series.

43.4 Records Per File: What Premium Consumer Endpoints Look Like

The ~43.4 rec/file yield for this batch -- significantly above the 24-37 range typical of MIX batches -- reflects endpoints with dense credential stores. Whether that's heavy browser users with dozens of saved logins, machines running Chrome or Edge with synced credential vaults, or endpoints where infostealer malware had extended dwell time, the result is the same: each compromised machine yielded roughly 43 credential pairs covering 43 different URLs. For victims, this means more attack surface exposed per device. A single infected laptop contributing 43 entries to a stealer log means 43 separate accounts to audit and secure.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records -- including stealer log batches like this QLogs VIP 500 PCS release. If your email appeared in a July 2025 infostealer haul, you can find out immediately at HEROIC's breach scanner and take action before your credentials are exploited.