This is an interesting point. The attacks probably did have a significant financial cost to the banks and their customers, but harm is not the only factor that

This is an interesting point. The attacks probably did have a significant financial cost to the banks and their customers, but harm is not the only factor that goes into sentencing. Judges often recognise that young people are less deserving of punishment due to their natural inexperience and weaker ability to foresee consequences. To be rehabilitated, they may only need to grow up, and a severe punishment is unnecessary. Also the nature of intent and forethought are important, but are interpreted differently. Some jurisdictions tend to punish an easy crime like a DDoS less, because less planning and premeditation suggests a less guilty mind could commit the crime. Other jurisdictions punish more, because they want a greater deterrent.