A financial institution is trying to estimate potential losses of cybercrime. A competitor has just reported that it had a loss of $220 million due to a DDOS attack. Given that the institution has annual revenues of $1.3 billion, and the competitor has revenues of $5.3 billion, what would the institutions estimated potential loss be closest to according to Shih et. al?