QLogs VIP 900 MIX: 27,993 US Credentials Leaked Nine Days After Collection (Aug 2025)

Nine Days From Harvest to Market: QLogs VIP 900 MIX Tracks the Operator's Turnaround Window

QLogs VIP 900 MIX 19-08-2025 hit on August 28, 2025 -- nine days after its August 19 collection date. That gap is more than just a logistical footnote. It traces the operator's pipeline: from infostealer campaign active on victim machines, through exfiltration, sorting, and packaging, to final distribution to VIP-tier buyers. For the 27,993 US victims whose credentials appear in this 900-file batch, that nine-day window was the interval between compromise and marketplce exposure. In many cases, credentials may have already been tested or sold before any alert reached the affected accounts.

QLogs VIP 900 MIX (August 2025): Stealer Log Summary

• Records Exposed: 27,993
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: August 28, 2025

The Aug 28 Triple Release: Three Batches, One Day

QLogs VIP 900 MIX was one of three separate batches released on August 28, 2025. The other two -- VIP 940 MIX (Aug 16 collection) and VIP 1000 MIX (Aug 15 collection) -- landed the same day. Together, the three batches account for 85,803 US credentials across 2,840 endpoint files. The simultaneous release of multiple batches with different collection dates is a common operator pattern: harvest runs are staggered, but distribution is coordinated for market impact or buyer convenience. The Aug 28 triple drop made it one of the highest-volume single-day QLogs releases documented in the series.

900 Files at 31.1 Records Per File: Consistent MIX-Tier Yield

At ~31.1 records per file, VIP 900 MIX falls solidly within the expected range for QLogs MIX-tier batches. Across the documented series, MIX batches run from about 24 to 37 records per file -- reflecting a broad consumer endpoint pool without the concentrated high-value sessions that would push the average higher. The 900 endpoint count is mid-range for QLogs batch sizes; the operator has released batches from 500 files (the anomalous PCS variant) up to 1,575 files. VIP 900 MIX represents a standard operational run -- competent, consistent, and scaled for volume.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records -- including stealer log credential sets like this QLogs VIP 900 MIX batch. If your email was swept up in an infostealer haul, you can check immediately at HEROIC's breach scanner and take action before your credentials are misused.