One is that there is some secret keeping happening. Either only a handful of people actually know and they aren't talking and the people issuing denials aren't them, or there is some kind of significant pressure from the US or China to keep this quiet and the companies are complying.
Or there could be some kind of misunderstanding. The story is half true but some details are wrong so people are looking in the wrong places or asking the wrong people. This happens sometimes with anonymous sources. You get fifteen people confirming most of the details but only one is offering the name of the company or some specific detail of the attack and that person got that detail wrong, something like that.
Or the entire story could be unadulterated crap. The problem with this one is that we can't ever be really sure it was the case, and it will be at least a couple of months without any form of hard evidence or corroboration before it makes sense for people to stop looking for it.