They have to pay back the direct damages that they caused. They don't have to pay all of the damages resulting from the initial damage. If the money they took caused someone's car to be repossessed which caused them to lose their job, they don't have to pay for the lost income from the job.

Well, under this ruling they don't have to. But the victims didn't sign off on this, they are perfectly entitled to sue for whatever they think they deserve. (Though if they intend to do so they should absolutely not accept the money they try to give them as a result of this deal, as that will make their case that much harder to win)