Apparently not, since I'm not sure what you are referring to (which means I also can't tell if it's sarcasm, which it looks like it might be?).

That said, I only mentioned payment in the case where the anonymous sender seemed to be helpful, in that they provided the way the server was infiltrated (presumably in an effort to allow it to be fixed). I didn't mention how much money to offer, or what to do at all in the case where it appears to be the beginning of a shakedown, other than to note that it's naive to assume you can rid yourself of them by just dealing with the one server referenced.

Edit: Ah, found the LastPass submission. Definitely sarcasm. ;)

You are forgetting some externalities re: value of being legitimate vs. criminal (e.g. contracts vs. ransom, legit money vs. tainted money, morality, fame, etc).

Not really. The hacker wants to get the most money from you possible, but also an amount that you are realistically able to provide otherwise he/she gets nothing. The maximum amount a company can realistically pay is probably much less than the total value of the company.