April’s $600 million in losses came from governance and infrastructure vulnerabilities.