The article says "In the incident, hackers used sophisticated malware to take remote control of a workstation running a Schneider Electric Triconex safety shutd

The article says "In the incident, hackers used sophisticated malware to take remote control of a workstation running a Schneider Electric Triconex safety shutdown system" "Remote control" certainly implies that it was connected at least indirectly to the internet, though something like a direct dial-up modem or leased line compromise could also be possible.