Cyber crime cost estimates in general are self serving and unreliable. I can't answer specifically for the cost to the US, but there is a great demolition of estimates released in the UK on the excellent UK site Straight Statistics.
Here is a flavour of their analysis:
For IP theft, the report admits there are no robust estimates for actual levels. It further admits that such thefts are not widely reported. So maybe there aren’t any? At the other extreme, it posits that every bit of IP that is worth stealing is in fact stolen, and then concludes that the truth lies somewhere between the two.
So how much is stolen? The report remarks: “The proportion of IP actually stolen cannot at present be measured with any degree of confidence”. So the assumption is made that the amounts stolen are proportional to their value to the thieves. It then produces estimates, industry by industry, of the amounts stolen rather like a magician producing rabbits out of a hat. No actual examples are cited. We are expected to believe that the theft of IP costs £9.2 billion a year without a single case of such theft being advanced. This is closer to guesswork than analysis.
When big estimates that serve the interests of the provider of the estimate are made, it is always worth looking at the detail and asking skeptical questions about it. The big numbers rarely stand up.