> "Employees of the company spend X number of days responding to the incident, and you take their fully loaded cost and divide it out by the number of days they spent having to deal with the incident, and that's a big number."
That should be discounted by the amount of time they spent getting their site up to basic good practices, if any. Otherwise it makes hacking the incompetent a greater crime than cracking in to a high-value hard target.
Damages are damages. If I throw a bowling ball into your garage late at night, is it "fair" that I have to pay more because you own a new Ferrari while the damages would be much less if you owned a 15 year old Honda?
Once you commit a tort, it's generally all on you.
That should be discounted by the amount of time they spent getting their site up to basic good practices, if any. Otherwise it makes hacking the incompetent a greater crime than cracking in to a high-value hard target.