The Athletic article made clear that the Yankees definitely were, and then vaguely said that "other teams" were doing the same. Then there was an SI article (
here) that said the following: "Two sources familiar with the investigation, which lasted three months and included more than 70,000 e-mails and 60 interviews, said various Astros personnel told MLB investigators about
eight other teams who used technology to steal signs in 2017 or 2018–such was the culture of the time."
The question, as noted above, is how many teams were doing this after the Sept. 2017 memo - I think MLB has acknowledged that anything prior to that is basically out of bounds in terms of punishment because the rules were less clear.