The attack affected customers in 24 states, but was limited because UPS Store franchised locations run on isolated networks.