Have you read the report? It doesn't even do that. It points to several different types of "viruses" (actually malware, but the report uses the word "virus") as potentially being present and then goes onto say "well, if the servers were patched properly this wouldn't have happened. Oh by the way, here's the list of patches to apply!"
The entire "report" is a fucking joke and was written by some half-assed dumb-ass intern working in a closet somewhere. To try and claim that report as "analysis" of a hacking incident strains all credulity!
I have read the report. My brief description was of the inference, not of the report.