Change reportedly paid the BlackCat/ALPHV ransomware gang $22 million after the previous cyberattack that crippled the company's claims processing systems. The post from the new group means Change could be the victim of a "double extortion" attempt, cybersecurity researchers say.

" It is not uncommon, as an incident responder, to discover not just one threat inside of a compromised environment but two or more," Ken Dunham, cyberthreat director at Qualys Threat Research Unit, told Becker's. "It is also not uncommon for companies that give in to bad actors performing extortion, such as ransomware and distributed denial-of-service payouts, to become 'soft targets,' quickly hit again with additional forms of extortion."

However, he added, "While nobody advocates paying off an adversary, sometimes it is an action that ends up being the best course of action for a business based upon their risks and needs at the time of breach and impact."

At the same time, paying ransom demands could open the door to additional attacks.

Related: State Department offers $10M reward for ID of Change Healthcare hackers

"The fact that Change Healthcare was seemingly targeted again, possibly by the same actors under a new alias or affiliates, highlights a significant issue in the ransomware ecosystem — the lack of 'honor among thieves'," Javvad Malik, lead security awareness advocate for KnowBe4, told The Register. "While the initial payment of $22 million might have seemed like a resolution, it potentially opened the door for further extortion. It's a stark reminder that paying a ransom not only fails to guarantee data safety or non-disclosure but might also paint the organization as a repeat target for future attacks."