US Users Targeted in the 9,117-Record TOR_LOG MIX 247pcs Breach

TOR_LOG Channel Releases 9,117 US Credentials in a 247-File Mixed Batch on October 21, 2023

TOR_LOG MIX 247pcs arrived on October 21, 2023 as part of the same multi-channel release cluster that brought Monster Cloud Free 1/2/3, crypton_logs 2.0, TG hulk_logs 600 LOGS, and several other stealer log batches to breach tracking databases in a single day. The naming convension is consistent with other TOR_LOG releases: channel name + content type (MIX) + file count (247pcs). At 247 files averaging ~36.9 records each, this batch sits above the mid-range yield threshold for stealer logs of this era, indicating reasonably productive endpoint targeting rather than mass low-quality harvesting. The TOR_LOG operator also released a smaller 162-log MIX batch the previous day, suggesting an active multi-day distribution event.

TOR_LOG MIX 247pcs (October 2023): Stealer Log Summary

• Records Exposed: 9,117
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: October 21, 2023

Decoding the TOR_LOG Naming Convention

TOR_LOG MIX 247pcs follows an explicit naming schema shared with other Telegram-distributed stealer log packages: the channel identifier (TOR_LOG), the content type (MIX, meaning a heterogenous blend of endpoint targets rather than a focused industry or geography), and the precise file count (247pcs). This "pcs" suffix -- short for pieces -- is a ubiquitous underground market term inherited from the physical goods trade and repurposed to describe discrete credential files. The MIX designation distinguishes this batch from more targeted releases that might filter for specific services or regions. Mixed batches cast a wider net and are typically released as free or introductory samples, while filtered premium tiers carry higher prices due to their specificity.

Above-Average Yield in a Mixed-Endpoint Harvest

The per-file yield of ~36.9 records places TOR_LOG MIX 247pcs among the better-performing batches in the October 2023 stealer log wave. For reference, TG hulk_logs 600 LOGS -- released the same day -- averaged only ~25.4 rec/file despite its larger total. The higher yield in TOR_LOG's batch suggests either better-provisioned target machines (devices with more saved browser credentials), more aggressive credential harvesting from each infected endpoint, or some filtering to exclude extremely low-yield log files before distribution. Any of these implies a more sophisticated or selctive operaton than a simple mass-infection spray-and-pray campaign.

TOR_LOG's Two-Day October Release Pattern

TOR_LOG released both a 162-log MIX on October 20 and this 247-log MIX on October 21, 2023. The consecutive-day pattern mirrors what Monster Cloud did across Oct 21-22 -- an operator distributing accumulated harvest across multiple days rather than releasing everything at once. The Oct 20 batch was smaller (162 files, 2,365 records at ~14.6 rec/file) while the Oct 21 batch is larger and better-yielding. This progression -- smaller release followed by a higher-quality larger release -- may reflect the operator pre-screening files and releasing lower-quality logs first while keeping premium inventory for the second-day drop, or simply the natural timing of when files became available from the harvesting infrastructure.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion exposed records, including TOR_LOG MIX 247pcs and the related October 2023 stealer log cluster. If your email and credentials appear in this batch or any of the surrounding same-day releases, HEROIC will identify it and help you secure the affected accounts. Run a free check now at HEROIC's breach scanner.