It only affecting one datacenter is good news, IMO:

It makes it likely that the attackers didn't breach Tietoevry itself, or that they had only very limited access (unless Tietoevry has incredibly good separation between business units, so that only a small subset is affected).

That increases the chance that the customers have to deal with an outage, not an outage followed by ransom demands and their customer data being leaked.