There must have been some off-the-books arrangement, maybe the installation who supplied the malware paid for the damages and the bonds, which might have been such a large amount that the installation had then failed and ceased operation. Maybe the company thought that was punishment enough.