Steady income is definitely the way to play. You don’t want to make a demand so large that there’s cheaper alternatives of dealing with you.

Also you want the company to stay in business so it can continue generating revenue to extract future ransoms, and not have it lose a bunch of its customers from your repeated attacks.