Something that may not be obvious is how victims (companies, at least) frequently want to bury the story just as much as the person who conned them. "We lost 8 digits of internet money last night and have no idea who did it" just doesn't sound good to other people who are supposed to trust you.

Exactly there is a reason most APTs stay as some designation without any real people identified

Sampling bias would probably fit.