From what I've read, things started going wrong when an (ex?) official of the US released information the Dutch shared with their American allies[1]. Details on when or why access to the Russian networks was lost aren't readily available (secret service and all that) but I do remember reading about the intelligence agencies being not particularly pleased with the way the information was publicly released by their allies. It makes sense that someone gloating about how there's an ally of theirs in your network will make you take a second look at the traffic flowing through your network if you're waging cyber warfare.

[1]: https://www.washingtonpost.com/world/national-security/new-d...