What we know – and still don’t – about the worst-ever US government cyber-attack