My understanding is they did limit the attack to the office side:

> After Colonial Pipeline reported that its corporate computer networks were hit by the ransomware attack, the company shut down the pipeline as a precaution due to a concern that the hackers might have obtained information allowing them to carry out further attacks on vulnerable parts of the pipeline.

https://en.wikipedia.org/wiki/Colonial_Pipeline_cyberattack