US Data Breach: prdscloud 306logs Exposed 5,724 Accounts

prdscloud Releases Two Batches on October 20 -- 306logs Adds 5,724 Records Alongside the Larger 1214logs

The prdscloud operator released two distinct stealer log batches on October 20, 2023. The first -- prdscloud 1214logs -- contained 40,336 US credentials across 1,214 files at ~33.2 rec/file, the largest single release in the October 20 cluster. The second, prdscloud 306logs, contains 5,724 records across 306 files at ~18.7 rec/file. The combined October 20 prdscloud output: 1,520 files and 46,060 US credential records in a single day. Two-batch same-day releasing is another engagement tactic in the underground market: it doubles the channel's post count, creates a second notification event for subscribers, and demonstrates to potential buyers that the operator has a large enough harvest to split across mulitple packages rather than releasing everything in one shot.

prdscloud 306logs (October 2023): Stealer Log Summary

• Records Exposed: 5,724
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: October 20, 2023

Yield Differential Between prdscloud's Two October 20 Batches

prdscloud 306logs averages ~18.7 records per file, compared to ~33.2 rec/file for the 1214logs batch released the same day. This differential -- nearly half the yield -- is analytically interesting. It may indicate that the 1214logs batch was assembled from better-quality endpoint harvests first, with the 306logs batch containing the remaining files that didn't meet the operator's primary curation threshold. Alternatively, the two batches may derive from different geographic sub-pools or different phases of the harvesting campaign with different endpoint profiles. Either interpretation suggests the operator had enough inventory to cherry-pick for the first batch while still having a secondary release worth distributing -- a sign of significant harvest scale.

How a Single Operator Releasing 46,000+ Records in One Day Looks

The combined 46,060 records from prdscloud's October 20 double release is the single-operator, single-day record for the October 20-21 cluster, exceeding Monster Cloud's October 21 trilogy (31,913 records) and far exceeding any other channel's October 20 output. In practice, a 46,000-record single-day release from one operator means 46,000 distinct compromised US endpoints contributed credentials to that day's distribution. Each represents a real machine that was infected with infostealer malware, a real person whose browser credential store was exfiltrated, and a real set of plaintext passwords now in the hands of anyone who downloaded prdscloud's two October 20 packages from Telegram.

prdscloud 306logs in the October 20 Cluster

Beyond prdscloud's own double release, October 20 saw batches from LOGS_CENTER (25,478), SNATCH_CLOUD FREE (10,809), HUBHEAD_LOGS FREE (5,724), STAKE_LOGS (4,165), CRYPTON_LOGS 2.0 (3,505), ANDRIANA CLOUDFREE (3,365), TOR_LOG MIX 162logs (2,365), SMOKERCLOUD FREE (2,291), and OTTOMANGIFT (70). Prdscloud's combined 46,060 represented roughly 45% of the entire October 20 stealer log volume -- a dominant share that, alongside Monster Cloud's later performance, identifies prdscloud as one of the most prolific operators in this particular late-October 2023 period.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion exposed records, including both prdscloud releases from October 20, 2023 and the full surrounding multi-operator cluster. If your email address appears in either batch or any related October 2023 stealer log release, HEROIC will identify the exposure. Run a free scan at HEROIC's breach scanner.