In a December regulatory filing, the company provided further information, including that it had connected some of the forged cookies to "the same state-sponsored actor believed to be responsible for the data theft the company disclosed on September 22, 2016.