I don't get the ransom thing: users of a git repository have a clone of the repo that contains the whole history, no? So isn't it trivial to recreate the repository?
The attacker is also threatening to make these private repos public, or misuse their access to the repos in other ways (likely additional types of breaches).