Seems like the biggest chain in Sweden, ICA, had a VPN. They were affected but only the franchise takers that were (for whatever reason) outside their internal network.

Same in Finland, Kesko said they've heard reports from systems NOT connected to their centralized monitoring systems.

You can lead a horse to water, but ...