I think that’s a bit harsh. The early pages provide a high level overview of the timeline of the event and the impact on services. The mission statement is more

I think that’s a bit harsh. The early pages provide a high level overview of the timeline of the event and the impact on services. The mission statement is more of a list of key activities, and is only there as framing for a breakdown of what is currently broken and what still works. While I too would like more technical details, I think the report is pretty clear that they don’t know how the attackers broke in, but they do know horizontal spread was extremely easy due to a wide array of outdated systems and a very non-compartmentalized network. While knowing exact vectors and CVEs would be somewhat interesting, a) I don’t think it would substantially change the key messages of the report and b) it’s almost certainly some fairly boring long-since-patched vulns in legacy software.