Well a single 48 hr mitigation costs 12k/yr contact. Unlimited mitigations probably cost about 130k/yr. Either this negative PR is worth 12-100k in savings for them or they would drop any paying customer if the attack is over a certain threshold?
They might bill you that money, but on average it costs them less to provide that service to you, otherwise they wouldn't make any money.
Because we don't know the operating margins and the distribution of DDoS costs per customer, we can't infer how much this particular attack would cost Akamai.
