Hackers already received a $22 million payment. Now a second group demands money.