Hacks incur legal costs and engineering time to mitigate (even if just to do postmortems) which are both extremely expensive resources. $10 million doesn't seem at all unreasonable for multiple Fortune 500 firms getting breached.
That's the corporate equivalent of losing $10.
You’re not wrong, but it’s worth emphasising “fortune 500”, because it’s their own fault it costs them that much. Would be a negligible fraction of that for normal companies.