I think "falls apart" is overreaching. If the claim was that 21 states were targeted by russian hackers, and only two states repudiate that, that's less than a 10% error rate.
Keep in mind that state governments want to make sure they aren't deemed incompetent. But anyone who knows anything about "the cyber" knows that there are tons of legacy systems at both the state and federal level which are wide open to possible attacks.
The suggestion that an adversary could "scan" the networks is totally within the realm of plausability. This is the first step of a cyber attack, and while an individual state may be able to conclude that they weren't successfully attacked, it doesn't mean they weren't targeted to begin with.
Keep in mind that state governments want to make sure they aren't deemed incompetent. But anyone who knows anything about "the cyber" knows that there are tons of legacy systems at both the state and federal level which are wide open to possible attacks.
The suggestion that an adversary could "scan" the networks is totally within the realm of plausability. This is the first step of a cyber attack, and while an individual state may be able to conclude that they weren't successfully attacked, it doesn't mean they weren't targeted to begin with.