It's never made clear; however, since by the time Merchanter's Luck takes place Sandor Kreja has been alone for some time and was living in reduced circumstances for a time before that, it is quite possible that the attack occurred when Signy Mallory and Norway were still part of the fleet, i.e. before events of Downbelow Station.
So Signy might well know, but she ain't talking.
Since throughout Downbelow Station and at several times in other books it is made abundantly clear that irrespective to any piddling peccadillos Mallory and Norway are a breed apart and have not stooped to piracy and generally frown on bad behaviour, I think that we may take it on faith that Norway was not the offender.
Somehow she managed to run a tight, well-disciplined and ethical ship under conditions under which doing so was not all that easy, and my hat is off to her.