And there's no mention in there of the fact that Red Hat people helped diagnose the intrusion (if that's the Debian intrusion I remember about, might well have been another one).
And it's easier to report about a break-in when the problem has been diagnosed. It's most likely still being diagnosed and plugged before making the full timeline public.