I'll believe evidence - not authority.

That's a good sentiment to have.

The evidence has been released by both Crowdstrike and FireEye. They both have fairly detailed writeups of them. Attribution is an important part of computer security. FireEye has a similar reputation for attribution and forensics as Kaspersky.

The NYT article mentions that the Russian groups Crowdstrike identified ('Cozy Bear', 'Fancy Bear') were working independently of each other. If two groups gained access independently, how is anyone sure that one or more other groups or individuals didn't also gain access? And the article never makes the link to how Wikipedia came to receive the information, only assumes it was one of the two Russian groups Crowdstrike identified.

These are good questions to ask. The right thing for you to do is study how a computer intrusion campaign works and how attribution is done. Everyone has their own limit of when they trust expert advice. For example, I refuse to trust my doctor's advice fully and pull up studies at home to verify what she tells me. It's good to learn more about computer security if it interests you.

It is extremely difficult, maybe impossible, to completely conceal one's pivots, implants, and exfiltration in a computer network. True, it is possible that an attacker that is more capable than GRU/Cozy Bear and FSB/Fancy Bear did just that and exfiltrated the emails and documents. But this is going beyond what the evidence suggests.

Is it just a matter of not trusting who has investigated? It would be weird to just reject whatever you haven't seen yourself as false. People have been wrong before but I think that there is a large line between scepticism and outright denial in these situations.

The white house, CIA, and FBI have a history of intentionally misleading and lying to the public.

The white house has used classified reports to publicly justify a conclusion that isn't in the original reports. WMDs in Iraq is a perfect example of this. They did this with Hillary's emails too.

For all we know the evidence is nothing but a Russian IP address in an access log.