Yes we should. There is no justification for why we meekly let them have at it cyberspace. It should be pain for pain. Russians will never learn until they feel pain.
I can think of some reasons why we should not retaliate against the Russian government. Perhaps we have more to lose in escalation. I don't know if this is true but it might be. If this is an attack at the behest/approval of the Russian government we don't know why they made the attack. It could be a response to something we did to them. We should not get riled up because what hasn't been reported is likely the real story. We just don't know and as citizens we ought not clamor for our leaders to respond. That sort of clamoring has in the past had very negative consequences.
We can entirely, safely remove Russia from the global Internet and we can do it trivially. That's exactly what we should do if they press attacks too far: isolate them. They have the increasingly government controlled Runet to restrict their people's access to the outside world, we should barricade them in.
Their economy is small, close to meaningless. It's nearly a rounding error at this point in the global economy and it'll continue to shrink in that relationship. The sole thing to be concerned about with Russia is their nuclear arsenal.
Their economy is small and ours large. Therefore we have more to lose possibly. Removing them from the internet will not prevent their ability to mount attacks. It makes it more difficult but not impossible. We cyber attacked an Iranian nuclear facility that was air gapped.
I like the concept of holding Russia (as with any country) responsible assuming they are, but your reply didn’t address the escalating pattern of tit for tat, and how to deal with that.
Perhaps a sort of cyber-MAD comes out of the escalation and the Russian government cracks down on the group to prevent their own serious infrastructure disruptions.