The companies involved used compromised software, but it’s not clear if hackers entered their networks. Finding out could be difficult.