I've been a huge advocate for revenue based penalties across the board. Base it off the revenue related to the affected users, and if that can't be determined, then it is the same percentage but based on all revenue as a fallback. And just to be sure it's a deterrent, triple that fine, treble damages is a favorite of the courts.