How would they contact the owner of the device? All they know is the IP address of the device.
that's pretty simple. tar and encrypt all their data. put a DO_YOU_WANT_IT_BACK.TXT file in the root next to it and in there provide instructions to pay the ransom.