True indeed - I've read that this group may have questionable statistics, so here's what I've done:
1) Emailed them.

I got a quick response, with a pointer to their FAQ. It talks about how they generate their numbers - in terms of economic dammages they take a few cases in across some domains and business types and extrapolate much larger numbers based on those (which is reasonable, considering you can't survey everyone). Unfortuantely, the FAQ is rather vague, and I don't believe they'd answer mre detailed questions unless I purchased one of their reports..

2) I'm asking again anyway.

I'll let you know if I hear anything.

l00p