QLogs_Offical 500 PCS May 13, 2025: 24,899 US Credentials at Near-VIP Yield Without the Label

Near-VIP Yield Without the Label: The QLogs_Offical 500 PCS May 13 Batch

The QLogs_Offical 500 PCS batch collected May 13, 2025 represents something interesting in the QLogs timeline: a PCS harvest operating at near-VIP yield levels before the VIP framework even existed. At approximately 49.8 records per file across 500 files and 24,899 total US credentials, this batch sits just below the 50+ rec/file benchmarks that would later earn the VIP designation for PCS releases. Released May 18 -- five days after collection -- it arrived alongside a companion 750 PCS batch from the same collection date, painting a picture of an operator already achieving quality results before standardizing how to label them.

QLogs_Offical 500 PCS (May 2025): Stealer Log Summary

• Records Exposed: 24,899
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: May 18, 2025

~49.8 Records Per File: The Pre-VIP Quality Ceiling

When the QLogs operator introduced the VIP label for PCS batches in late June 2025, it applied to releases where endpoint quality was demonstrably above baseline. The ~49.8 rec/file yield on this May 13 batch -- collected more than five weeks before the VIP framework emerged -- already clears that benchmark. Consumer endpoints yielding close to 50 credentials per device indicate multi-service users with dense browser stores: email accounts, financial portals, streaming subscriptions, e-commerce logins, all stored and all harvested in plaintext by infostealer malware. These are exactly the high-value endpoints that would later be curated into VIP-designated batches.

The May 13 Dual PCS Collection: Two Batches, One Day

The 500 PCS batch and its sibling 750 PCS batch were both collected on May 13 and both leaked on May 18 -- a five-day simultaneous staging window. The difference in file count suggests the operator either harvested endpoints in two seperate delivery batches or deliberately segmented the May 13 collection by quality or source. The 500-file batch's slightly higher per-file yield compared to the 750-file batch hints at the latter: a possible pre-sort where the denser endpoints were packaged together, while the remainder formed the larger 750-file archive. This kind of implicit quality tiering would eventually become explicit with the VIP label system.

Plaintext Credentials, Immediate Risk

Every one of the 24,899 records in this batch was captured live by infostealer malware running on a compromised US consumer device. No hashing, no encryption -- the passwords arrived in the breach ecosystem ready to use. For any account where the victum hasn't changed their password since May 2025, the credentials remain valid and actionable. Credential stuffing tools can cycle through these records against dozens of platforms simultaneously, identifying live accounts within hours of acquisition.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records -- including pre-VIP QLogs_Offical PCS batches like this May 13 collection. Run a scan at HEROIC's breach scanner to find out if your credentials were among those exposed.