A quick Google search has confirmed that Microsoft has confirmed at least the Russia part:

https://www.cyberark.com/resources/blog/apt29s-attack-on-mic...

It's very hard to argue that when you give 100,000 people access to materials that are inherently worth billions, none of them are stealing those materials. Google has enough leakers to conservative media of all places that you should suspect that at least one Googler is exfiltrating data to China, Russia, or India.