Change Healthcare faces second ransomware dilemma weeks after ALPHV attack

Change Healthcare is reportedly being targeted by a second ransomware/extortion group called RansomHub, which claims to possess 4 TB of the company's data including PII for active US military personnel, medical records, and payment information and is demanding ransom within 12 days. The report links this extortion to a recent ALPHV ransomware incident (with an alleged $22M payment), outlines theories that affiliates retained data or that ALPHV rebranded as RansomHub, and highlights potential operational and regulatory impacts while noting limited public confirmation.