This seems more like a slap on the wrist than anything. Especially since they were charging guests up to $1,000 per device to connect to the internet. Wow.
Edit: That's the $/connection point not $/guest. That's a bit more reasonable then.
Honestly, I figure that just the initial analysis of what they need to do will cost them that much before they actually start hiring personnel and putting the preventive actions in place.
Then factor in all the bad press they will get from this and the final bill will be well into the millions.