"State-sponsored actors" sounds like over-specification. If Yahoo detects a "sophisticated attack" from a lone jerk with a computer, do they not notify affected users of defensive actions to take?

It's no doubt interesting to know that your account is being targeted by your own or some other government, but identification seems secondary to detection and response.