Well according to the original article, the attack was targeted, implying the only way to get such a thing would be from one of the compromised customers, who a

Well according to the original article, the attack was targeted, implying the only way to get such a thing would be from one of the compromised customers, who are probably involved in an investigation into the matter, don't have all of the info themselves, and aren't super eager to release details to the public before a full picture emerges and mitigation procedures are in place. Further, going back to the original article, the majority of the information comes from alleged government sources, so not the people directly impacted, but rather those just helping deal with the fallout and coordination. Assuming there is merit to the story, it will likely be some time before more details emerge, unless having the story out there now helps accelerate that process.