They should mitigate the attack with a better action plan. DDOS are not new threats and the CIO is accountable. More annoying for paying customers like me. If my cable TV goes out, I would ask the cable company for some measure of compensation. If you're in the restaurant and order a steak, and the steak never arrives, would you still pay for it? Sure, the restaurant may have just been robbed, but I still want a refund.
Hm, good point about the refund. But I don't think it's reasonable to expect every company to prepare for massive DDoS attacks. The amount spent on mitigation should be proportional to expected loss.