Now i'm really curious if they calculate the prices based on the files they encrypt. Do you know if it was some kind of spear phishing attack or just a regular ransomware variant? Any sources? thx!

My guess is it's pretty easy for them to report back the infected computer is part of a domain, for example, which most businesses using Windows would be on.

I've heard of some non-scripted ransomware that "phones home". If it points you to an email exchange with the scammer, there's room for a person to sound you out, maybe google you or work off your email address and information reported by the ransomware.