The more important problem is that we don’t even know if this attack:
1) ever occurred
2) if it did occur, was it even the US
3) if it was even an attack, was it in fact a cyberattack at all (you would want to protect actual human assets who do physical damage in say industrial control systems as an insider job by saying it was a remote attack using some sort of zero day attack)
Anonymous government sources, especially in cyber security, have a track record of persistent lying
Remember the China chip hacking story by Bloomberg built on anonymous government sources. The alleged fake news was never retracted - even though it was technically not a possible attack if you know how chips are made. (There are chips that had arguably deliberately installed flaws - the Intel chip with the OTP generator that was trivially crackable and the RSA keyfob with the default NSA backdoor).
Anonymous government sources, especially in cyber security, have a track record of persistent lying
Remember the China chip hacking story by Bloomberg built on anonymous government sources. The alleged fake news was never retracted - even though it was technically not a possible attack if you know how chips are made. (There are chips that had arguably deliberately installed flaws - the Intel chip with the OTP generator that was trivially crackable and the RSA keyfob with the default NSA backdoor).
https://www.bloomberg.com/news/features/2018-10-04/the-big-h...
https://siliconangle.com/2018/10/22/apple-amazon-super-micro...
https://www.wired.com/2013/09/rsa-advisory-nsa-algorithm/