Austrian authorities have refused to publish the serial numbers of nearly 500,000 carbon allowances stolen from its registry in last month's cyber attack, in a move that has prompted fresh criticism of the European Commission's handling of the fraud.