My guess is it's pretty easy for them to report back the infected computer is part of a domain, for example, which most businesses using Windows would be on.

I've heard of some non-scripted ransomware that "phones home". If it points you to an email exchange with the scammer, there's room for a person to sound you out, maybe google you or work off your email address and information reported by the ransomware.