Armed Robbery Simile
Many armed robberies cause less fiscal loss than many DDOS attacks and the damage can be much longer lasting for a wider and unpredictable amount of the population. Where the robbery also causes actual physical or mental harm then the sentence should be increased to reflect those 'enhanced damages'.
If the DDOS had resulted in actual deaths as it might well have done since the effects of stupidity are always hard to control, then the sentence should reflect those enhanced damages.
DDOS is NOT a victimless crime.
As an agent of change ii is also a dangerously close to 'I will bomb you until you change', I believe that is also considered an illegal act punishable under the law.
This sad and victim filled saga appears to have been sadly lacking in rational consideration, not an unknown situation when people become irrational as some are suggesting the hospital might have been. (I take those comments on trust as I am not going to research the full background as I doubt I could gain access to probably privileged information.)