The issue is complicated. So far there's no proof for Newag involvement. It's very different to how security researchers publish their results. All is based on hearsay.