Reuters discusses a White House Council of Economic Advisors report stipulating malicious cyber activity could potentially have cost the US economy between $57 and $109 billion in 2016:

The report quoted the U.S. intelligence community as saying the main foreign culprits responsible for much cyber activity against U.S. targets are Russia, China, Iran and North Korea.

But it also said malicious cyber activity is not limited to foreign actors. Corporate competitors, activists seeking to advance a political agenda and organized crime are also responsible, it said.

The report said effective public and private-sector efforts to combat the illicit activity would contribute to gross domestic product growth.

Those numbers are huge. I am genuinely curious how they arrived both at those specific dollar figures, and that large gap between the lower and upper threshold. Quantifying malicious cyber activity is so ambiguous I find it almost hard to believe those are realistic amounts.