Given the scope of the attack I think it’s reasonable to assume all high value targets were compromised in someway. It’s more a matter of what specifically was compromised, what data was exfiltrated, how much of the attack was offline, are Thunder going to start breaking a as la stuxnet etc.