>It's also something they'll never have to prove or verify so from a PR perspective I disagree. In breaches like these, attribution discussion begins pretty qu

>It's also something they'll never have to prove or verify so from a PR perspective I disagree. In breaches like these, attribution discussion begins pretty quickly after the announcement. If researchers find evidence it was some script kiddie or a black hat group or whatever, that would embarrass Yahoo even more. If you don't know who the attacker is, you have nothing to lose by saying you were compromised by a sophisticated adversary in a targeted attack. You have more to lose by saying a nation-state attacked you if they actually didn't.