I think in cases like this I would rest easier if law enforcement always probed, targetting not the hackers (because I don't think that helps), but the company complicit in victimizing its users. Those companies have an extreme amount of power&knowledge, and should be held to extremely high standards as a result.
It seems like a sophisticated attacker running a targeted attack such as a government agency would presumably have avoided doing anything noticeable like the public tweets in the hope of being able to avoid detection and target additional people in the future.