Long-tail damage to governments and hospitals is definitely part of it - there's very little upper bound on how much ransomware can cost if you botch the respon

Long-tail damage to governments and hospitals is definitely part of it - there's very little upper bound on how much ransomware can cost if you botch the response badly enough. And given how much ransomware simply doesn't decrypt if you pay, there's no reason the ransom prices should have any real correlation to the damage inflicted. The other part of it appears to be some slightly funny calculations. If ransomware shuts down Target's online store for a day, Target might compute the loss based on 24 hours of no revenue, but purchases that go to Amazon, or to Target a day later, shouldn't be added into total "damage". The dollar value being computed there is something more like disruption.