Sophos came to the $5.9 million figure by identifying which Bitcoin addresses the hackers had been using to receive the ransom payments. In total, they identified 157 unique addresses and estimate 233 victims gave in to the ransom demands.
Source Link
