“attackers might eventually pocket more than $1 billion worldwide”