It's a strong statement but it definitely leaves the door open. Given that there's so much at stake I can't imagine a different statement. On the other hand, i

It's a strong statement but it definitely leaves the door open. Given that there's so much at stake I can't imagine a different statement. On the other hand, if you read the CISA alert[1], it's clear that (1) many industrial targets were compromised, given the ubiquity of the Orion product and the amount of time that transpired; and (2) the attackers had their merry f'ing way with MS products like AD. So at this point I think it would be more surprising if they were not compromised than if they were. [1]https://us-cert.cisa.gov/ncas/alerts/aa20-352a https://us-cert.cisa.gov/ncas/alerts/aa20-352a