In the first days and likely first weeks after a cyber attack occurs and/it becomes public - it is absolutely irresponsible to jump to attribution. And to my journalist friends I’m sorry but you’re making this worse when you quote these folks. It’s absolutely damaging.
Most importantly; we should all remember to use attribution, but not over-use. This is of course also dependent if an investigation is still on-going, and the impact it may have. Attribution is useful for specific cases and sometimes internally only, imho.