If they claim it was a state-sponsored attack and then a non-state-sponsored hacking group makes a credible claim to have been the perpetrators, Yahoo will look even worse than they do now. I doubt Yahoo is saying 'state-sponsored' just for PR.

Have anybody found out who was behind any of the recent and not so recent large scale DDOS talked about also here on HN?

Besides, "they" don't claim anything. "They" cleverly claim that "_it_ believes" it was a state-actor. Who is this _it_ they conveniently hide?

The whole article refers to Yahoo in the third person, and "it" is also referring to Yahoo.

Occam's Razor applies here: the simplest explanation is that they are telling the truth, insofar as they have been able to establish it.

In a communist country, isn't every corporation a state actor ;) ?

Also, although of course many states could do something with the data... I still wonder why they'd auction it on a marketplace.

We'll later learn that Archive.org bought the data... "to bootstrap their new museum on Internet archeology" /s.