Sorry but what else can someone outside these orgs do in this case? There’s really no way to know unless the companies involved give us more info, and the author seems to have done a great job in presenting a possible scenario.
(I guess an investigative journalist could start interviewing staff promising anonymity)