It should be based on no. of user impacted and avg. impact to each user. Revenue/Margin are should not be primary driver. We don't convict murderer/thief depending on their net worth (if any it is tilted on wrong side).
In fact you should probably subtract the direct costs to users, as there is already a mechanism in place for collecting damages, and any government intervention on this axis should go to something reminiscent of a victim's fund.