QLogs VIP 500PCS: 14,914 US Credentials in Same-Day Jul 20, 2025 Release

QLogs VIP 500PCS: 14,914 US Credentials Released the Same Day They Were Harvested

QLogs VIP 500PCS 20-07-2025 -- note the compact naming with no space between "500" and "PCS" -- surfaced July 20, 2025, the same day as its collection date. Like the July 22 VIP 500 PCS batch released two days later, this batch carries zero staging window. The 14,914 US credentials span 500 endpoint files at ~29.8 records per file. That yield is the lowest among the July 2025 VIP PCS batches -- below the 38-43 rec/file seen in the other same-day releases -- suggesting either a lighter credential density on these endpoints or a narrower infostealer deployment scope.

QLogs VIP 500PCS (July 20, 2025): Stealer Log Summary

• Records Exposed: 14,914
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: July 20, 2025

"500PCS" vs "500 PCS": A Naming Variation Within the QLogs Convention

The batch name "QLogs VIP 500PCS 20-07-2025" drops the space between "500" and "PCS" that appears in other batches. This is almost certainly an operator typo or formatting inconsistency rather than a distinct product category. The underlying batch structure is identical to the spaced variants: 500-file count, VIP tier designation, PCS endpoint type, European date format. The compact naming has no apparent effect on the data itself -- the 14,914 records and plaintext credential format are consistent with every other 500-type PCS batch in the series. The minor naming variance is worth noting for analysts tracking operator behavior patterns across a dataset, as even small consistencies or deviations in naming conventions can fingerprint specific actors or campaigns.

July 20 in the QLogs Timeline: Between Two Other Same-Day Releases

July 20 sits between two other same-day VIP PCS releases: July 13 (VIP 600 PCS, 25,111 records) and July 22 (VIP 500 PCS, 19,275 records). All three were collected and released the same day. This clustered pattern of immediate-release small PCS batches in mid-July 2025 suggests the operator was running a high-velocity distribution model during this period: short infostealer campaigns generating 500-600 endpoint files, packaged immediately, and distributed to VIP buyers without staging. The July 20 batch, at 14,914 records and ~29.8 rec/file, is the smallest and lowest-yield of the three -- but the distributoin speed is identical.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records -- including same-day stealer log releases like this QLogs VIP 500PCS batch. If your email was part of a mid-July 2025 infostealer campaign, you can check now at HEROIC's breach scanner and take action to secure your accounts.