Your Passwords May Be Exposed: The TOR_LOG MIXED 1316pcs Breach

TOR_LOG Opens Its October Series With 1,316 Files and 16,201 US Records on October 19

TOR_LOG MIXED 1316pcs, released October 19, 2023, is the first and largest of three consecutive TOR_LOG releases across October 19-21. The series: Oct 19 MIXED 1316pcs (16,201 records, 1,316 files), Oct 20 MIX 162logs (2,365 records, 162 files), Oct 21 MIX 247pcs (9,117 records, 247 files). The Oct 19 batch is larger than the next two combined by a wide margin -- it holds 58% of the operator's three-day total. This inverse release pattern -- largest first, then smaller -- differs from the escalating pattern used by CRYPTON_LOGS and Monster Cloud. TOR_LOG apparently front-loaded its October distribution event with the biggest batch, then released smaller secondary drops over the following two days.

TOR_LOG MIXED 1316pcs (October 2023): Stealer Log Summary

• Records Exposed: 16,201
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: October 19, 2023

"MIXED" vs. "MIX": Consistent Operator, Varying Label

TOR_LOG's October 19 batch uses "MIXED" while the October 20 ("MIX 162logs") and October 21 ("MIX 247pcs") batches use the abbreviated "MIX." This minor label variation across three releases from the same channel is a common artifact of stealer log operators who don't maintain rigid naming consistency -- the content type is the same (heterogeneous, non-filtered endpoints), but the label abbreviated over time, possibly as the operator adopted a more standardized format after the initial release. Both MIXED and MIX convey the same information to buyers: this is a general-population endpoint harvest with no category filtering, available to any use case from broad credential stuffing to targeted sector testing.

1,316 Files: TOR_LOG's Largest Endpoint Harvest in the Series

With 1,316 files, TOR_LOG MIXED 1316pcs represents 1,316 compromised US machines whose browser credential stores were exfiltrated by infostealer malware. At ~12.3 records per file, the yield is lower than the Oct 21 batch (~36.9 rec/file) but the sheer file count makes this the TOR_LOG series' largest absolute record total. The low per-file yield across 1,316 files may indicate the operator included all harvested files without quality filtering -- a full raw dump rather than a curated release. The subsequent Oct 20 and Oct 21 batches with higher yields but lower file counts may represent the operator's filtered or curated secondary releases, keeping their best-performing logs for the follow-up drops.

TOR_LOG as the Dominant October 19 Operator

With 16,201 records, TOR_LOG was the largest single-channel contributor to October 19's stealer log cluster, outpacing crypton_logs (6,670), 302 PCS FREE LOGS (4,434), BananaLogs (2,866), and all five Monster Cloud Oct 19 batches combined (~4,637). TOR_LOG's October 19 release accounted for roughly 46% of the entire day's US credential exposure. The operator would return the next two days with smaller releases, but the October 19 batch established TOR_LOG as a significant actor in this particular multi-day credential distribution event -- not just a peripheral channel but one of its core contributors.

Check If Your Data Was Exposed

HEROIC's free breach scanner covers more than 400 billion exposed records, including all three TOR_LOG releases from October 19-21, 2023. If your credentials appear in MIXED 1316pcs or any related TOR_LOG batch, HEROIC can identify the exposure and help you secure affected accounts. Run a free scan at HEROIC's breach scanner.